JFrog SAST VSCode Extension

The JFrog SAST Extension for Visual Studio Code provides a dedicated environment for displaying, visualizing, and triaging SAST scan results. It offers a priority dashboard, data flow visualization, suppression workflows, baseline comparison, and real-time scan-on-save — all focused exclusively on SAST findings.

This extension is separate from the main JFrog VS Code Extension. Use it when you want a specialized SAST triage experience with features like flow graph visualization, finding baselines, and SARIF import/export.

Before You Begin

You need the following:

• JFrog CLI installed and configured (jf c add to set up a JFrog Platform server).
• JFrog Advanced Security license(SAST capability enabled).

To verify that SAST is enabled, run jf audit --sast in an empty folder and confirm that SAST results banner is printed. The first execution may take additional time to download the scanner distribution.

Running a Scan

• Click the Scan button in the Scanner sidebar to scan the source code in the current workspace.
• To scan a different folder, select Browse from the dropdown menu.
• Click Stop Scan to cancel a running scan.

Findings Report

• Dashboard - Card-based severity breakdown of the most important issues
• All Findings - Sortable, filterable table of all issues Selecting an issue opens the associated Flow Graph (if available) or navigates directly to the affected source code location.

Flow Graph

The Flow Graph visualizes the data flow analysis associated with each finding, displaying the affected parts of source code and the relationships between them.

• Click on nodes to navigate to the relevant source code locations.
• Annotate each data flow node with remarks or mark it as Fixed or False Positive.
• Marking all nodes as Fixed or False Positive updates the status of the full issue.

Suppressions and Remarks

You can triage findings directly within the extension:

• Mark issues as Fixed or False Positive.
• Add notes to specific locations in the code.
• All suppressions and remarks are persisted in the SARIF file when you save the report.

Findings Baseline

Use a baseline to surface only new findings and hide previously known issues.

• Click Set Report as Baseline and import a SARIF file from a previous scan.
• Findings that already appeared in the baseline are hidden from the current results.
• Click Clear to remove the baseline and display all findings again.

Scan on Save

When enabled, saving a file (manually or automatically) triggers a SAST scan in the context of the current file. Results are posted to the VS Code Problems panel in real time.

You can enable or disable this feature in the extension settings under jfrog-sast.scanOnSave.enabled.

Workspace Trust

Running a scan executes the JFrog CLI against your code, so scanning (including scan-on-save and the SAST server) is only available in trusted workspaces. Importing SARIF files and viewing the dashboard and flow graph remain available in untrusted (restricted) workspaces.

AI-based result validation

You can use Google Gemini to evaluate the validity of the results produced by the analysis in order to reduce the number of false positive findings resulting from contextual reasons. In order to perform the validation, configure the following environment variables for jf CLI by setting JFrog CLI env in the extension settings:

• JF_SAST_GEMINI_API_KEY - API key to Gemini instance
• JF_SAST_AI_VALIDATION - should be set to true
• JF_SAST_GEMINI_MODEL - model name to use, defaults to gemini-pro-latest The results are displayed in AI Validation Score column (optional) in All Findings table.

Saving and Loading Reports

• Click Save Report in the sidebar to save the full report data (including suppressions and remarks) to a SARIF file.
• Click Load Report to import any SARIF 2.1.0 file. Suppressions and remarks are restored from files previously saved by the extension.

Fingerprints

For comparison and reference outside the extension, use Copy Fingerprints to copy issue fingerprints to the clipboard. Fingerprints are robust to unrelated code changes and can be used to recognize logically equivalent findings across scans.

Configuration

All settings are under the jfrog-sast namespace:

VS Code Commands

License

Apache 2.0