Oryon Security Extension

Oryon 2.0.3 is a security extension for Visual Studio Code. It combines local static analysis, dependency vulnerability scanning, AI-assisted remediation and synchronization with the Oryon dashboard.

Privacy: SAST runs locally. Oryon sends only the finding context required for enabled AI features and the data required for authentication or dashboard synchronization.

What 2.0 Delivers

• Bundled and integrity-checked OpenGrep 1.25.0 runtime.
• Intrafile taint analysis. Cross-file dataflow is not claimed.
• Fail-closed scan integrity: engine errors, global timeouts, skipped rules, skipped targets and incomplete coverage fail the scan instead of publishing partial results.
• Broader rules for application code, infrastructure, configuration, secrets and AI/agent security.
• production_security ruleset by default, retaining every useful category and excluding only explicitly audited entries.
• Persistent dependency and AI-enrichment caches.
• Parallel code and dependency detection.
• Optional AI triage, disabled by default.
• AI enrichment for code and dependency findings when the account and subscription permit it.
• Project linking, shared false-positive suppressions and dashboard sync.

See CHANGELOG.md for the complete release history.

Analysis Coverage

Oryon recognizes application languages including JavaScript, TypeScript, Python, Java, Go, PHP, C, C++, C#, Ruby, Rust, Kotlin, Scala, Swift, Solidity, Apex, Clojure, Elixir and OCaml.

It also recognizes HTML and server templates, Bash, Dockerfile, Terraform, YAML, JSON, XML, JSONnet, Gradle, Nginx, OpenAPI, Kubernetes and common CI/CD formats. Some formats use parser-independent rules because their embedded template syntax is not accepted by the OpenGrep parser.

Recognition means that the target is admitted to the appropriate scan rail; it does not imply identical benchmark depth for every language. Current measured coverage and known gaps are recorded in docs/evaluation/DETECTOR_COVERAGE.md.

How a Workspace Scan Works

1. Oryon builds a deterministic manifest, applying .gitignore, configured globs, generated/vendor exclusions and the 2 MiB target-size limit.
2. Code and dependency detection run concurrently.
3. OpenGrep selects applicable rules and scans exact language, template and generic-security phases under one global deadline.
4. If enabled, AI triage runs over code findings. It is off by default, so no detector finding is removed by AI in the default configuration.
5. Code and dependency findings are enriched concurrently when AI is available.
6. Results are published locally and synchronized after a project is linked.

The scan is not reported as complete if the local detector cannot prove that all planned rules and targets were processed.

Getting Started

1. Install Oryon from the Visual Studio Code Marketplace.
2. Open the Command Palette and run Oryon: Login.
3. Open a repository and run Oryon: Scan Workspace.
4. Link the repository to an Oryon project from the Oryon Hub to synchronize results with the dashboard.

The bundled runtime supports Linux x64/arm64, macOS x64/arm64 and Windows x64. No global OpenGrep, Python runtime or Docker installation is required.

Results

The results view supports:

• Source, language, CWE and severity filters.
• AI explanations and remediation guidance.
• Opening the affected file or a prefilled issue.
• Applying a generated fix.
• Shared false-positive suppression and restoration.
• JSON and CSV export.

The sidebar provides authentication, workspace switching, project linking, scan progress, result totals and dashboard access.

Configuration

Configure Oryon from Settings > Extensions > Oryon.

oryon.backend.baseUrl is application-scoped. Workspace-provided backend origins are ignored, and production accepts only trusted Oryon origins.

Offline and Network Behaviour

• Code scanning works offline after the OpenGrep runtime has been extracted from the installed extension.
• Dependency vulnerability lookup requires OSV unless a valid cached result is available.
• Login, entitlements, AI enrichment, shared suppressions and dashboard sync require network access.
• An AI failure preserves the original detector finding; it does not turn the detector result into a false clean scan.

Documentation

• User guide
• Developer guide
• Architecture
• AI workflow
• Ruleset profiles
• Detector evidence
• Documentation index

Support

Open View > Output, select Oryon, reproduce the problem and include the relevant log section in the support report. Never include access tokens, ephemeral AI keys or private source code that is unrelated to the failure.