Cloud security scanner is built to identify vulnerabilities in your Google App Engine applications. The scanner crawls through your application and can attempt to try multiple user inputs in order to detect vulnerabilities. The scanner can detect a range of vulnerabilities, such as XSS, flash injection, mixed content, clear text passwords, and use of JavaScript libraries.

Cloud security scanner can only be used with the Google App Engine standard environment and compute engine. You cannot use the security scanner with a Google App Engine flexible environment. When requested, cloud security scanner does not start immediately but is queued by GCP to scan the app at a later time when the load is low. It is advisable to run the security scanner in a lab environment. Running cloud security scanner in a production environment can create undesirable data. For example...