---
title: app security record
description: Record agent findings from an app security check.
source_url:
  html: 'https://shopify.dev/docs/api/shopify-cli/app/app-security-record'
  md: 'https://shopify.dev/docs/api/shopify-cli/app/app-security-record.md'
api_name: shopify-cli
---

# app security record

Records the findings that your coding agent reports after an [`app security check`](https://shopify.dev/docs/api/shopify-cli/app/app-security-check). The command reads the agent's complete findings document from standard input, validates it, and replaces any findings recorded earlier. If anything in the document is invalid, then the command lists every error and records nothing.

You don't usually run this command yourself: the instructions that `app security check` prints tell your coding agent how to run it. To see the combined results afterward, run [`app security review`](https://shopify.dev/docs/api/shopify-cli/app/app-security-review).

The command needs the results of an earlier `app security check`. Pass it the same `--path`, `--config`, `--client-id`, and `--without-app-config` flags that you passed to [`app security check`](https://shopify.dev/docs/api/shopify-cli/app/app-security-check), so that the command finds the same results.

#### Flags

The following flags are available for the `app security record` command:

* **--client-id \<value>**

  **string**

  **env: SHOPIFY\_FLAG\_CLIENT\_ID**

  The Client ID of your app.

* **--json-schema**

  **env: SHOPIFY\_FLAG\_JSON\_SCHEMA**

  Print the command's JSON schemas.

* **--no-color**

  **env: SHOPIFY\_FLAG\_NO\_COLOR**

  Disable color output.

* **--no-input**

  **env: SHOPIFY\_FLAG\_NO\_INPUT**

  Disable interactive prompts and browser authentication.

* **--path \<value>**

  **string**

  **env: SHOPIFY\_FLAG\_PATH**

  The path to your app directory.

* **--verbose**

  **env: SHOPIFY\_FLAG\_VERBOSE**

  Increase the verbosity of the output. May include sensitive data.

* **--without-app-config**

  **env: SHOPIFY\_FLAG\_WITHOUT\_APP\_CONFIG**

  Scan --path as an app with no app configuration file. Config checks are skipped. Requires --client-id.

* **-c, --config \<value>**

  **string**

  **env: SHOPIFY\_FLAG\_APP\_CONFIG**

  The name of the app configuration.

### Examples

* #### App security record

  ##### app security record

  ```sh
  shopify app security record < findings.json
  ```

***