FLCN Security — Credential & Vulnerability Guard

Real-time protection against leaking secrets, API keys, and vulnerable dependencies to AI coding assistants and public repositories.

Features

Credential Detection

• Real-time scanning — underlines detected credentials as you edit, with inline diagnostics
• 20 built-in detectors — covers all major cloud providers and services (AWS, OpenAI, Anthropic, GitHub, Stripe, GCP, and more)
• Quick-fix actions — redact a credential or suppress with an inline comment in one click
• Warn on open / save — alerts whenever a file containing credentials is opened or saved
• Redact file — replaces every detected credential in the active file with [REDACTED:Kind]

Dependency Vulnerability Scanning

• OSV.dev — queries the Open Source Vulnerabilities database for all dependency manifests
• GitHub Security Advisories (GHSA) — queries the GitHub Advisory Database directly for same-day CVE coverage
• NVD (NIST) — queries the National Vulnerability Database for CVEs not yet in OSV
• npm audit — runs npm audit locally for Node.js projects; catches advisories the moment they are published
• Supports package.json, requirements.txt, Cargo.toml, Gemfile, and go.mod
• Configurable scan interval (default: every 60 minutes) and auto-scan on project open
• Results shown inline in the Problems panel and in the dedicated FLCN Security panel

Security Dashboard

• Open with FLCN Sec: Open Security Dashboard or click the status bar item
• Live Issues — credential and vulnerability cards at the top, updated in real time
• Settings controls — toggle every option without leaving VS Code
• Loading progress — per-scanner status ("Scanning GHSA…", "Scanning NVD…") while scans run

FLCN Security Panel

• Dedicated tab in the bottom panel (alongside Output and Terminal)
• Problems-panel style — credentials and vulnerabilities in collapsible sections
• Click a credential row to jump to the file and line
• Click a vulnerability ID to open the advisory in your browser

Git Pre-commit Hook

• Installs a pre-commit hook that blocks commits containing credentials
• Manage from the dashboard or via command palette

AI Context Exclusions

• Writes .cursorignore and disables Copilot for .env, *.pem, SSH keys, and other sensitive file types
• Applied automatically when a sensitive file is first opened

Built-in Detectors

Commands

Settings

Credential Guard

Vulnerability Scanning

Custom Detectors

"flcn-sec.customDetectors": [
  {
    "name": "MyApp Token",
    "pattern": "myapp_[A-Za-z0-9]{32}",
    "flags": "g"
  },
  {
    "name": "DB Password",
    "pattern": "DB_PASSWORD\\s*=\\s*(\\S{12,})",
    "flags": "gim",
    "group": 1
  }
]

Allowlist

Suppress known-safe findings without disabling the detector:

"flcn-sec.allowlist": [
  {
    "description": "Placeholder values in docs",
    "valuePattern": "^(YOUR_|REPLACE_ME|example|placeholder)",
    "detectorName": "Env-style Secret Assignment"
  },
  {
    "description": "JWTs in test fixtures are fake",
    "detectorName": "JSON Web Token",
    "filePattern": "**/*.test.*"
  }
]

Claude Code Integration

FLCN Sec ships with a companion Claude Code hooks plugin that adds hook-level protection to the Claude Code CLI:

• UserPromptSubmit — blocks prompts containing credentials before they reach the model
• PreToolUse — redacts credentials from file reads and bash output; hard-blocks writes containing secrets; scans package install commands (pip, npm, cargo, gem) against OSV/GHSA/NVD before executing
• PostToolUse — alerts if a credential slipped through in a tool result

See the companion hooks/ directory for setup instructions.

License

GNU Affero General Public License v3.0

Any project that uses, modifies, or builds on FLCN Security must also be released as open source under the AGPL v3 (or a compatible license). This includes projects that expose the extension's functionality over a network.