LeapFix

LeapFix is a powerful VSCode extension designed to perform SAST methodology or static security analysis on your code. It scans the lines of code in your files for vulnerabilities, providing descriptions and links on "how to fix the vulnerabilities" found. This allows developers to identify and fix vulnerabilities while coding. The extension identifies different types of vulnerabilities across various frameworks and programming languages.

Plugin free

This plugin is completely free and does not require authentication, registration, create an account or generate credentials.

Supported language(s) and Frameworks(s)/Plataforms(s)

Language	Framework(s)/Platforms(s)	File Extension(s)
Dart	Flutter	`.dart`
Go	Go, Protobuf	`.go`, `.proto`
JavaScript	Angular, NodeJS, React and VueJS	`.js`, `.jsx`, `.mjs`, `.cjs`
PHP	CakePHP, CodeIgniter, Kohana, Laravel, Smarty, Symfony,bWapp, etc	`.php`, `.php3`, `.php4`, `.php5`, `.phtml`, `.pthm`, `.tpl`, `.ctp`
Python	DJango, FastAPI, Flask, PyQt, Tkinter,Kivy, etc	`.py`, `.pyw`
Perl	Dancer2,Mojolicious,Catalyst,Plack, Mason,Moose,Dist::Zilla etc	`.pl`, `.pm`, `.psgi`, `.plx`
Ruby	Ruby on Rails	`.rb`, `.rake`, `.gemspec`
TypeScript	Angular, React and VueJS	`.js`, `.jsx`, `.mjs`, `.cjs`
ADVPL	TOTVS Framework AdvPL	`.prw`, `.prx`, `.tlpp`

Industrial / OT Systems

SAST Scan also provides security analysis capabilities for Industrial Control Systems (ICS) and Operational Technology (OT) environments.

The extension supports security analysis of source code, configuration files, and project-related files used across PLC, SCADA, HMI, RTU, and industrial automation platforms.

The supported technologies include major industrial automation vendors and IEC 61131-3 programming environments, such as Siemens, Rockwell Automation, Beckhoff, Schneider Electric, Mitsubishi Electric, CODESYS, Omron, B&R, WAGO, and Phoenix Contact.

The SAST engine can identify potential security issues in industrial code and configuration, including insecure communication, hardcoded credentials, improper input validation, insecure configuration, command injection, and other security weaknesses.

Supported Industrial Technologies

Icon	Technology / Manufacturer	Environment / Platform	Tags / File Extensions
	Siemens	TIA Portal / STEP 7	`.scl`, `.awl`
	Rockwell / Allen-Bradley	Studio 5000 / Logix Designer	`.l5x`
	Beckhoff	TwinCAT	`.tcpou`
	CODESYS	CODESYS	`.st`
	Schneider Electric	EcoStruxure Control Expert	`.st`
	Mitsubishi Electric	GX Works	`.st`
	Omron	Sysmac Studio	`.st`
	B&R	Automation Studio	`.st`
	WAGO	CODESYS / e!COCKPIT	`.st`
	Phoenix Contact	PLCnext Engineer	`.st`
	IEC 61131-3	Structured Text	`.st`
🖥️	SCADA	SCADA Systems	`.scada`
🖥️	HMI	HMI Systems	`.hmi`
📡	RTU	Remote Terminal Unit	`.rtu`
🏷️	Tags	SCADA / HMI Tag Configuration	`.tag`, `.tags`
⚙️	Configuration	Industrial / Embedded Configuration	`.cfg`, `.conf`, `.ini`

How to use

Run a new scan from your IDE even before committing your code or project.

To make the plugin scan and search for vulnerabilities in your code, press:

Ctrl+Shift+P

Select the command:

Run SCAN

This command will scan the current file for vulnerabilities.

Se vulnerabilities are found, a tab will open pointing out the details of the vulnerabilities, along with a description and links on how to fix them.

Industrial and OT Code Scan Results

During industrial code scans, detected vulnerabilities are highlighted in the results tab:

Watch the video to see how LeapFix identifies vulnerabilities across different industrial technologies:

Web and Desktop Application Scan Results

During code scans, detected vulnerabilities are highlighted in the results tab:

Watch the video to see how LeapFix identifies vulnerabilities across different programming languages:

Vulnerability remediation detail

When we scan the lines of code and vulnerabilities we find examples of how to fix the vulnerabilities. For a better understanding of vulnerabilities, we offer an example of vulnerable code and an example of safe code to implement in your application. I see examples of how developers will view the breakdown and example of vulnerable and secure code:

1 - Remote Command Execution - GoLang

2 - Insecure Deserialization - Ruby

3 - Potential SQL Injection in SELECT - PHP

4 - XSS via Unsanitized Output - TypeScript (ReactJS)

5 - TLS 1.0: Insufficient Cryptographic Algorithm Strength - ADVPL

6 - XML External Entities (XXE) - Python

7 - Improper Certificate Validation - JavaScript

8 - Improper Use of Cookies - PHP

9 - Insecure Communication - Dart

10 - Potential SQL Injection in SELECT - ADVPL

The LeapFix

The word Leap means to jump and fix means to correction vulnerabilities. But the combination of Leap fix means a "quick fix". This is exactly the purpose of plugin: to provide developers with the opportunity to look for vulnerabilities while developing their code, without needing web platforms to make them aware of the vulnerabilities.

Contributing

The plugin was created by Fernando Mengali.

License

This project is licensed under the MIT License.

LeapFix sast scan

Fernando Mengali