⚡ Why CodeDigger?

Modern security tools often force developers to choose between two extremes:

1. Cloud-dependent AI scanners that can hallucinate findings, introduce latency, and upload proprietary code to third-party servers.
2. Legacy noisy linters that flood the workspace with hundreds of pre-existing alerts, paralyzing developer productivity.

CodeDigger solves both problems. It provides an enterprise-grade, zero-AI deterministic Static Application Security Testing (SAST) engine directly inside VS Code and your CI/CD pipelines, with native Git Diff intelligence that highlights only the risks introduced or worsened by your recent changes.

🌟 Key Features

 ┌─────────────────────────────────────────────────────────────┐
 │                      CodeDigger Engine                      │
 └──────┬───────────────────────┬───────────────────────┬──────┘
        │                       │                       │
 ┌──────▼──────┐         ┌──────▼──────┐         ┌──────▼──────┐
 │     AST     │         │   Secrets   │         │ Dependencies│
 │ (TypeScript │         │  (Pattern + │         │ (Google OSV │
 │Compiler API)│         │  Redaction) │         │  + Offline) │
 └──────┬──────┘         └──────┬──────┘         └──────┬──────┘
        └───────────────────────┼───────────────────────┘
                                │
                         ┌──────▼──────┐
                         │   Git Diff  │ ──► Focus on NEW risks
                         │ Correlation │     Ignore legacy debt
                         └──────┬──────┘
                                │
            ┌───────────────────┴───────────────────┐
            │                                       │
     ┌──────▼──────┐                         ┌──────▼──────┐
     │   VS Code   │                         │ Headless CLI│
     │ Diagnostics │                         │  for CI/CD  │
     │  & Sidebar  │                         │ (Exit code) │
     └─────────────┘                         └─────────────┘

1. 🧬 Deterministic AST Analysis (No LLM Hallucinations)

Powered by the official TypeScript Compiler API, CodeDigger parses source code into an Abstract Syntax Tree (AST) to evaluate executable nodes, call expressions, and variable bindings. Every alert is mathematically provable and reproducible.

2. 🎯 Git Diff Intelligence ("Changes Only" Mode)

Never get blocked by technical debt written years ago. CodeDigger correlates AST findings with git diff -U0 HEAD to distinguish between:

• ✨ New in Git Diff: Risks introduced by the developer in the current working session.
• Pre-existing: Legacy issues already committed to the base branch.
• A single click on the Changes Only filter cleans your view so you focus strictly on what you are touching.

3. 🔑 Zero-Leak Secret Scanner

Detects active credentials, tokens, and hardcoded secrets across multiple cloud providers (AWS, Google Cloud/Firebase, GitHub tokens, and generic API keys).

• Mandatory Redaction: Secret values are masked in the UI, terminal, and reports (AKIA...MPLE) to prevent credential leakage during screen-sharing or code reviews.

4. 📦 Hybrid Dependency Auditor (Google OSV + Instant Local)

Automatically audits package.json for known vulnerabilities (CVEs and GHSAs):

• Instant Offline Database: Immediate feedback on high-profile vulnerabilities (jsonwebtoken, lodash, axios, minimist, express).
• Live Google OSV.dev Integration: Asynchronously checks the global Open Source Vulnerability index via batch API queries within a strict 3-second timeout.

5. 💡 Actionable Quick Fixes & Documented Suppressions

Hover over any underlined vulnerability to open VS Code's Lightbulb menu (or press Cmd + .):

• One-Click Auto-Remediation: E.g., automatically replace dangerous innerHTML assignments with safe textContent.
• Documented Baseline Suppression: Insert standardized audit comments (// codedigger-ignore <RULE_ID> -- reason: [justification]) to trace security exemptions directly in Git review history.

6. 📊 Enterprise SARIF & Markdown Reporting

Export comprehensive audit reports in one click:

• Markdown (.md): Human-readable tables ideal for Pull Request summaries, Notion, or Jira.
• SARIF 2.1.0 (.sarif): The OASIS industry standard, fully compatible with GitHub Advanced Security, GitLab Security Dashboard, and Azure DevOps.

7. 🚀 Standalone CI/CD CLI

Run the exact same scanning engine headlessly in GitHub Actions or pre-commit hooks via npm run scan. CodeDigger returns an exit code 1 upon detecting blocking vulnerabilities to protect production pipelines.

📋 Detection Catalog

🖥️ User Interface Overview

Dedicated Activity Bar View

Click on the CodeDigger Shield icon in the Activity Bar to reveal the security tree view:

• Severity Grouping: Issues categorized by CRITICAL, HIGH, and MEDIUM.
• Click-to-Navigate: Click any finding to instantly jump to the affected line in the editor.
• Navigation Toolbar Buttons:
  • ▶️ Scan Workspace: Recursively scan all JavaScript, TypeScript, and package.json files.
  • 🔀 Toggle Changes Only: Filter results strictly to Git-modified lines.
  • 📄 Export Security Report: Export findings as Markdown or SARIF.

 🛡️ CODEDIGGER SECURITY: DETECTED VULNERABILITIES  [▶️] [🔀] [📄]
 ├── 🔴 CRITICAL (2)
 │    ├── Direct Arbitrary Code Execution (eval) • Line 4 • Pre-existing
 │    └── AWS Access Key detected • Line 6 • ✨ New (Diff)
 └── 🟠 HIGH (1)
      └── SQL Injection Risk (SQLi) • Line 26 • ✨ New (Diff)

🚀 Commands

Open the VS Code Command Palette (Cmd + Shift + P on macOS or Ctrl + Shift + P on Windows/Linux) and search for:

🤖 CI/CD Integration (GitHub Actions)

Add CodeDigger directly to your CI/CD pipeline to block pull requests containing critical vulnerabilities:

Create .github/workflows/security.yml:

name: Security Audit

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  codedigger-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Run CodeDigger Security Audit
        run: |
          npx esbuild packages/cli/src/cli.ts --bundle --platform=node --outfile=dist/cli.js
          node dist/cli.js

🔒 Privacy & Security Guarantee

• 100% Local-First: Source code analysis runs entirely inside your local VS Code runtime.
• No Cloud Uploads: CodeDigger will never transmit your source code, tokens, or reports to external servers.
• Safe Secrets Handling: Credential values are masked at detection time.
• Telemetry Disabled: No user tracking or code content collection.

📄 License

CodeDigger is released under the MIT License.