Pentesterra DevGuard — VS Code Security Extension

Pre-push security audit for your codebase.

DevGuard analyzes dependencies, secrets metadata, misconfigurations, AI toolchain risks, crypto weaknesses, and other security signals directly from your IDE before code reaches production.

Compatible with:

• VS Code
• Cursor
• Windsurf

---

Video Demos

Demo	Watch
DevGuard Demo
How to Use DevGuard
DevGuard - Business Logic
DevGuard - Credential Flow

---

Key Features

• Native VS Code, Cursor, and Windsurf workflow - no CI setup required
• Pre-push security gate that blocks risky commits before they leave the workstation
• Dependency vulnerability analysis across 15 lockfile formats
• Privacy-first secrets metadata detection with masked fingerprints only
• Risk scoring, severity classification, false-positive suppression, and finding verification
• Attack Vectors - code-to-impact path analysis from DevGuard findings
• Web dashboard handoff for scan history, detailed findings, and attack chain analysis

---

What DevGuard Covers

DevGuard is not only a dependency scanner. Current coverage includes 38+ risk modules:

Area	Modules
Supply chain	Dependency CVEs, known malicious packages, typosquats, peer dependency conflicts, deprecated dependency APIs, Python runtime execution hooks
Secrets & credentials	Secrets metadata, token liveness and blast radius, credential flow analysis, cloud credential surface, shell history scanning, commit message scanning
AI and agents	AI toolchain and MCP risk, AI agent configuration risk, LLM integration risk, prompt injection patterns, vector database exposure
Application security	SAST Lite, API route security, GraphQL security, endpoint/auth map, logic risk detection, business process detection
Platform risk	Crypto and TLS weaknesses, automation platform risk, Go security, PHP and CMS security, IDE plugin threat intelligence
Data and impact	Service dependency map, data asset classification, business impact report, attack vectors
Version control	Git pre-push gate, multi-VCS secrets protection, SVN history scan, SVN-to-Git migration pre-check
Noise reduction	Entropy-based secret filtering, suppression workflows, finding verification

---

Notable Modules

Supply Chain & Dependency Analysis

Parses npm, PyPI, Go, Rust, Ruby, PHP, Java, .NET, Swift, and Dart lockfiles. Dependencies are mapped against CVE, KEV, exploit availability, and malicious-package intelligence.

Secrets, Liveness & Blast Radius

Detects AWS keys, OAuth tokens, JWT secrets, private keys, database credentials, LLM keys, and other credentials. Secret values are never transmitted. When local verification is enabled for supported providers, DevGuard can tell whether a token is still active and what repositories, CI actions, webhooks, or services it may expose.

Credential Flow Analysis

Traces how detected credentials are used in code and configuration. This catches dangerous patterns such as LLM SDK calls routed through attacker-controlled proxy URLs, credentials forwarded to unexpected domains, curl-based exfiltration, secrets passed to unverified GitHub Actions, and credential-bearing MCP server configs.

AI Toolchain, MCP & Agent Risk

Detects malicious MCP server configuration, risky AI IDE plugins, dangerous agent tools such as shell or Python REPL execution, unsafe prompt construction, insecure agentic loops, LLM output piped into execution paths, and vector database exposure.

API, GraphQL & Business Logic

Builds route and auth maps for FastAPI, Flask, Django, Express, NestJS, Next.js, Rails, Spring, Gin, Echo, and Chi. Finds unprotected routes, auth regressions, BOLA/IDOR surface, unauthenticated GraphQL mutations, missing resolver authorization, and logic-risk classes such as missing authorization, bypassable workflow, unverified state transitions, race conditions, and mass assignment.

Data Asset & Service Mapping

Extracts ORM model metadata across SQLAlchemy, Django, Prisma, TypeORM, Sequelize, Mongoose, GORM, and ActiveRecord. Classifies financial, identity, PII, health, and credential data, then maps external services such as databases, LLMs, queues, object storage, auth providers, monitoring, and automation platforms.

Multi-VCS and SVN Protection

DevGuard can protect non-git workflows too. It supports shell-level commit checks for SVN, Mercurial, Perforce, and other VCS commands, scans terminal history and commit messages, inspects SVN revision history for secrets that survived rotation, and provides an SVN-to-Git migration pre-check before old secrets become searchable in a public Git host.

---

Supported IDEs

DevGuard works with:

• VS Code
• Cursor
• Windsurf

---

Supported Ecosystems (15 Parsers)

Ecosystem	Lockfile / Manifest
npm	package-lock.json, yarn.lock, pnpm-lock.yaml
Python	requirements.txt, Pipfile.lock, poetry.lock
Go	go.sum
Rust	Cargo.lock
Ruby	Gemfile.lock
PHP	composer.lock
Java / Kotlin	pom.xml, build.gradle, build.gradle.kts
.NET / NuGet	packages.lock.json
Swift	Package.resolved
Dart / Flutter	pubspec.lock

---

Installation

Install from VS Code Marketplace:

https://marketplace.visualstudio.com/items?itemName=pentesterra.pentesterra-devguard

Or install locally:

code --install-extension devguard.vsix

Cursor:

cursor --install-extension devguard.vsix

Windsurf:

windsurf --install-extension devguard.vsix

Antigravity:

antigravity --install-extension devguard.vsix

---

Prerequisites

DevGuard CLI

The extension automatically installs and updates the CLI on first use. For terminal or CI/CD workflows, install the CLI collector manually:

pip install pentesterra-devguard

Update the CLI:

pentesterra-devguard update

API Key

Generate an API key from:

https://app.pentesterra.com → DevGuard → API Keys

---

Quick Start

1. Open Command Palette
2. Run DevGuard: Configure API Key
3. Enter your dg_... API key
4. Run DevGuard: Scan Workspace

You can also trigger scans via the DevGuard sidebar.

---

Features

Scan Workspace

Collects security signals from your project:

• dependency metadata
• secrets metadata
• configuration risks
• cryptographic misuse
• supply-chain signals

Data is analyzed via the Pentesterra API using a three-stage analysis pipeline:

1. CPE matching
2. advisory correlation
3. LLM fallback analysis

---

Pre-Push Security Gate

DevGuard can install a real git pre-push hook that blocks pushes when vulnerabilities exceed a defined severity threshold.

Install from Command Palette:

DevGuard: Install Git Hooks (Pre-Push Gate)

Available thresholds:

critical
high
medium
none

Push can be bypassed with:

git push --no-verify

---

Scan on Push (Telemetry Mode)

DevGuard can automatically scan your workspace after every git push.

This mode does not block pushes and is useful for telemetry and continuous monitoring.

Toggle via:

DevGuard: Toggle Scan on Push

---

DevGuard Sidebar

Access DevGuard via the Activity Bar.

Panels include:

Status

Connection status, CLI version, scan configuration.

Projects

Your DevGuard projects with recent scan history.

Last Scan

Risk score and severity summary.

Git Hooks

Install or remove the pre-push security gate.

Credentials

Remove stored API key.

---

Results Webview

DevGuard provides a rich HTML results panel including:

• risk score gauge
• severity badges
• risk category cards
• findings table
• attack vectors analysis (code-to-impact paths)

The interface automatically adapts to light and dark themes.

---

Attack Vectors Analysis

DevGuard automatically generates Attack Vectors — code-to-impact paths based on your security findings.

Attack Vectors show how vulnerabilities, secrets, and misconfigurations can chain together to create exploitable attack paths.

What are Attack Vectors?

Unlike traditional Attack Chains (which require offensive testing), DevGuard Attack Vectors are potential paths identified through static analysis:

• Code-to-Impact Paths: From exposed secrets → service access → privilege escalation
• Dependency Chains: From vulnerable dependency → reachable code → RCE potential
• CI/CD Vectors: From CI/CD secrets → repository access → supply chain compromise
• Crypto Weaknesses: From weak crypto → offline attack → credential theft

Viewing Attack Vectors

Attack Vectors appear in:

1. IDE Command — Run DevGuard: Analyze Attack Vectors from Command Palette
2. Results Webview — Top 5 chains displayed with severity and evidence level
3. Web Dashboard — Full analysis at https://app.pentesterra.com/#/attackchains
4. CLI — pentesterra-devguard attack-vectors command

Triggering Analysis

You can trigger Attack Vectors analysis directly from your IDE:

1. Open Command Palette (Cmd+Shift+P / Ctrl+Shift+P)
2. Run DevGuard: Analyze Attack Vectors
3. Wait for analysis to complete
4. Choose to view in Dashboard or Results Panel

The analysis uses your latest DevGuard scan data to generate code-to-impact paths.

Evidence Levels

Each attack vector has a confirmation level:

• 🔗 Evidence-backed — Multiple DevGuard findings support the path
• 📦 Dependency-confirmed — CVE + reachable import context
• 🔑 Secret-backed — Exposed secret + service context
• 💭 Theoretical — Potential path requiring validation

Example Attack Vector

CRITICAL (Score: 9.2) — 🔗 Evidence-backed

exposed_secret_cloud → service_access → privilege_escalation → data_exfiltration

Impact: Unauthorized access to production cloud infrastructure

Attack Vectors help prioritize remediation by showing real-world impact of individual findings.

---

Screenshots

DevGuard Sidebar

(screenshot placeholder)

---

Scan Results

(screenshot placeholder)

---

Api Key Configuration

(screenshot placeholder)

Scan Results on Web App

(screenshot placeholder)

Attack Chain Analysis

(screenshot placeholder)

---

Graceful Degradation

Capability	CLI + Key	No CLI + Key	No Key
Scan workspace	✅	❌	❌
Scan on push	✅	❌	❌
Install git hooks	✅	❌	❌
View results	✅	✅ (HTTP)	❌
List projects	✅	✅ (HTTP)	❌
View quota	✅	✅ (HTTP)	❌

---

Usage Tiers & Quotas

DevGuard capabilities depend on your Pentesterra account tier and available quotas.

Capability	Free Tier	Developer Security	Extended Dev Security	Enterprise
Workspace scan	✅	✅	✅	✅
Dependency analysis	✅	✅	✅	✅
Secrets metadata detection	✅	✅	✅	✅
Pre-push security gate	✅	✅	✅	✅
Deep scan mode	—	✅	✅	✅
Extended risk categories	—	—	✅	✅
Advanced analysis engine	—	—	✅	✅
Enterprise integrations	—	—	—	✅

Full plan comparison and current limits:
https://pentesterra.com/pricing

---

Commands

Command	Description
DevGuard: Configure API Key	Set your API key
DevGuard: Scan Workspace	Run a security scan
DevGuard: View Last Results	Open results webview
DevGuard: Analyze Attack Vectors	Generate attack vectors analysis
DevGuard: List Projects	Show projects in sidebar
DevGuard: View Quota	Show quota usage
DevGuard: Toggle Scan on Push	Enable or disable auto-scan
DevGuard: Install Git Hooks (Pre-Push Gate)	Install pre-push hook
DevGuard: Uninstall Git Hooks	Remove git hook
DevGuard: Forget API Key	Remove stored credentials
DevGuard: Install CLI	Install Python CLI
DevGuard: Open Web Dashboard	Open Pentesterra dashboard

---

Settings

Setting	Default	Description
devguard.apiUrl	https://api.pentesterra.com	API endpoint
devguard.webAppUrl	auto	Web dashboard URL for report links. If empty, derived from API URL (api.* → app.*, :5000 → :3000)
devguard.cliPath	auto	Path to CLI binary
devguard.scanOnPush	true	Enable post-push scan
devguard.scanMode	standard	Scan mode (standard or deep)

---

Security Model

DevGuard never uploads source code.

Only metadata may be transmitted:

• dependency names and versions
• lockfile metadata
• configuration signals
• environment metadata

Secrets and credentials are never transmitted.

All analysis runs inside the Pentesterra knowledge base and advisory engine.

---

Architecture

Extension (TypeScript)
        ↓
CLI subprocess (Python)
        ↓
Pentesterra API
        ↓
Security analysis + knowledge base

The extension acts as an orchestration layer. All heavy analysis runs in the CLI and Pentesterra backend.

---

Build from Source

cd DevGuard/vscode-extension

npm install
npm run build
npm run package

Produces:

pentesterra-devguard-X.Y.Z.vsix

---

Troubleshooting

Scan stuck on "Server analyzing..."

If the scan progress notification shows "Server analyzing..." for a long time:

1. Open the Output channel: View → Output → select "DevGuard" from dropdown
2. Check for status updates: The CLI logs scan status changes every few seconds
3. Look for errors: API errors, timeouts, or connection issues will appear here

Common causes:

• Server-side LLM enrichment: Large projects with many dependencies may take 1-2 minutes for LLM analysis
• Network issues: Check if API is reachable
• Large payload: Projects with 1000+ dependencies may hit tier limits

The Output channel auto-opens after 60 seconds of waiting.

No output in Output channel

Make sure CLI is installed and working:

pentesterra-devguard --version

If not found, install:

pip install pentesterra-devguard

Scan completes but no results shown

Check the Output channel for JSON parsing errors. The CLI should output a JSON envelope with {"ok": true, "data": {...}}.

---

License

Copyright © 2024–2026 Pentesterra.

This software is proprietary and confidential.
Unauthorized copying, distribution, or use is strictly prohibited.