AlertaVuln for VS Code

RED / YELLOW / GREEN vulnerability and code-scan findings shown directly on the lines they affect, with fixes you can apply from the editor.

Sign in with your browser (Command Palette: AlertaVuln: Sign in) - the extension authenticates as you with a personal, revocable token, no keys to copy. See Setup below.

What it shows

• Dependency findings - CVEs in your manifests (package.json, *.csproj, requirements.txt, go.mod, Cargo.toml, composer.json, Gemfile), highlighted on the affected dependency line with severity, reasoning, and the fixed version when one exists.
• Code scan (SAST) findings - flagged lines from AlertaVuln's static analysis, highlighted the same way, with the rule, message, and a link to guidance.

Each flagged line gets a full-line colour wash, a gutter dot, and an end-of-line note; hover for the full reasoning and the available actions. GREEN (informational) findings are hidden by default - turn them on if you want the full list. A branded Dash view in the activity bar summarises RED/YELLOW/GREEN counts and lists every finding as a card; click a card to jump straight to the code.

Once you run a Fix, that line switches to the GREEN fixed style - colour wash, gutter dot, and an end-of-line "fixed - pending rescan" note - in place of its original severity, and the card's Fix button greys out. It stays that way until the next scan confirms the fix, at which point the finding either clears or gets re-flagged for real.

(Screenshots added before first publish.)

Fix and Fix All

Dependency findings with a known fixed version get a Fix action. What it does depends on where the vulnerable version is declared:

• Direct dependency - Fix edits the version constraint in your manifest (package.json, *.csproj, go.mod, ...), then runs the ecosystem's install (npm install, cargo update -p <pkg>, bundle install, ...) in that manifest's directory so the lockfile follows.
• Transitive dependency - a plain install can't move a locked transitive version, so Fix offers the two real remediations. Where the ecosystem supports overrides (npm / pnpm / yarn) you choose between:
  • Update in place - npm update <pkg> / pnpm update <pkg> / yarn upgrade <pkg>, which moves the dependency to the newest version your existing ranges allow. The clean fix when the fixed version is in range.
  • Force via override - edits the nearest package.json to pin the fixed version tree-wide (npm overrides, pnpm pnpm.overrides, yarn resolutions), then installs. Guaranteed even when a parent locks the old version. When it can read your lockfile, the extension names the blocking parents and recommends the path that will actually work.
  • Ecosystems without an override mechanism (cargo, composer, Bundler, NuGet, pip, Go modules) get the update-in-place command only.

Every command runs in the directory that owns the manifest/lockfile - the folder the finding came from, not the workspace root. Fix all dependencies applies each finding's recommended path across the workspace, groups the resulting commands so each directory gets one terminal, and reports what it did. Its Dash button greys out once every fixable dependency has been fixed, and comes back if a rescan turns up something new.

This extension does run your package manager for you - a deliberate change, because "Fix" that only edits a file and leaves the lockfile stale wasn't actually fixing anything. If you would rather review before anything executes, set alertavuln.autoRunFix to false: the terminal still opens in the right directory with the exact command pre-filled, and you press Enter yourself.

Fix with AI (bring your own assistant)

Code scan findings don't carry an automated fix. Fix with AI builds a complete remediation prompt from the finding, its reasoning, the flagged code, and guidance, and hands it to YOUR AI assistant - AlertaVuln has no model of its own. By default (alertavuln.aiAssistant: auto) it detects and opens whichever assistant you have installed - GitHub Copilot, Claude Code, Windsurf, Cursor, Continue, Cody, Cline, or Roo Code - remembering your last choice, and asks which to use when several are present and none is remembered yet. Set alertavuln.aiAssistant to ask to always be asked, to clipboard to never open anything, or to a specific assistant id (e.g. claude) to always hand off to that one - falling back to clipboard with a note if it isn't installed. The prompt is always copied to your clipboard too, so it works even with an assistant we cannot open directly. For Claude Code specifically, the extension also makes a best-effort attempt to send the prompt straight into an already-open conversation via its exported API; when that isn't available it falls back to opening Claude Code and you paste the copied prompt. Nothing about the finding or the code leaves your machine through this extension.

Fix all critical (code scan) with AI batches this up. Rather than cramming every RED code-scan finding into one chat message - which hits the AI chat's character limit once there are more than a handful - it writes them to a scratch file, Alertavuln-AutoFixWithBYOAI.md, in the workspace root (grouped by file, as L<line>: rule - description, no code snippets), opens that file, and hands the assistant a short prompt pointing at it instead. The file is added to .git/info/exclude on a best-effort basis so it can't be committed, and its own last line asks the assistant to delete it once every finding is fixed. It appears next to the Code Scan group in the dash whenever there is at least one RED finding, or run AlertaVuln: Fix all critical code-scan findings with AI from the Command Palette.

Setup

1. Run AlertaVuln: Sign in (Command Palette). Your browser opens, you authenticate with your existing AlertaVuln login, and the editor is signed in - nothing to copy. This mints a personal, user-level token tied to your own account (so the extension sees your projects and access), valid for 90 days and revocable any time under Settings > Access tokens. The token only reads findings and is stored in VS Code's secret storage.
   • Advanced / CI alternative: run AlertaVuln: Set API key with a ReadOnly organization API key instead. Org keys are org-level; Sign in is preferred for a personal editor.
2. Open a workspace whose git remote matches a project's connected repository in AlertaVuln. The extension matches your workspace to a project by that repository URL automatically; if it can't (monorepos, multiple remotes), run AlertaVuln: Choose project for this workspace or set alertavuln.projectId.
3. Optional: install the AlertaVuln CLI (https://get.alertavuln.com) to run local, offline code scans with AlertaVuln: Scan with local CLI - your source never leaves the machine and it doesn't count against any quota.

Settings

Advanced / dev note: setting the ALERTAVULN_API_URL environment variable overrides the API base URL for the process running the extension, ahead of any settings.json value. A dev/test knob, not a contributed setting.

Commands

• AlertaVuln: Set API key
• AlertaVuln: Refresh findings
• AlertaVuln: Choose project for this workspace
• AlertaVuln: Fix all dependencies
• AlertaVuln: Scan with local CLI
• AlertaVuln: Fix with AI (BYO agent)
• AlertaVuln: Fix all critical code-scan findings with AI
• AlertaVuln: Open finding

Learn more

Full docs: https://docs.alertavuln.com