Spectra Code

Spectra Code is a Visual Studio Code extension that helps users identify and assess vulnerable dependencies in their projects and enabled VS Code extensions, directly within VS Code.

It connects to the ReversingLabs APIs and scan supported manifest files from popular package ecosystems such as npm and PyPI.

The analysis results are displayed inline and in the activity bar to provide clear visibility into risks across multiple SAFE Assessment categories, including malware, tampering, vulnerabilities, secrets, hardening, and licenses.

Designed for software developers, Spectra Code provides detailed dependency analysis by identifying affected assessment categories and highlighting potential risks. This helps developers track third-party risks and maintain project security and compliance without leaving the editor.

Requirements

To start working with Spectra Code, you'll need the following:

• Visual Studio Code (latest stable release recommended)
• A Spectra Assure account (Community or Portal; see below)
• An internet connection, since analysis data is fetched from the ReversingLabs APIs

Account and token tiers

Spectra Code supports two account types, each with its own token type and API quota:

Note: Changing tiers within the same service does not require a new token. You can continue using the same Community token when switching between Community Free and Community+, or the same Portal token when changing between Portal tiers. However, switching between Community and Portal authentication requires changing the token type.

For details on rate limits and upgrading, see the API usage tiers guide.

To get a token:

1. Community tier: Create a free account on the Spectra Assure Community sign-in page (Google or GitHub sign-in supported). Portal tier: log in to your Spectra Assure Portal account on your Portal instance.
2. Generate a token from your profile.
3. Copy the token and store it somewhere safe. This is the only time the token is shown to you and it cannot be retrieved again later.

Authentication

Spectra Code requires a user token to access the ReversingLabs APIs and retrieve analysis reports for your project dependencies.

Running the extension for the first time prompts you to either create an account or enter your user token. If you use a Portal token, you'll also be asked for your Portal instance domain name (for example, my.secure.software/demo or {region}.secure.software/demo).

Once entered, your token is validated: a success message shows the active token type, while a failure message indicates the token is invalid.

Updating your token

Use the Update User Token command whenever you need to:

• replace a token that has expired or been revoked
• switch from a Community token to a Portal token, or vice versa

Note: Generating a new token does not reset your monthly API usage, since usage is tied to your user account rather than the token itself. However, switching between Community and Portal tokens does move your usage from one quota to the other (from Community API to Portal API, and vice versa).

If you want to remove access entirely rather than replace it with a new one (for example, before uninstalling the extension), use the Delete User Token command instead. This clears the stored token from VS Code completely.

Usage

When you first install Spectra Code, the walkthrough opens automatically, introducing the extension and guiding you through the first steps. You can reopen it any time via the Open walkthrough command in the Command Palette.

Spectra Code works at the folder level, so make sure the folder containing the package you want to scan is added to your VS Code workspace.

On startup or when opening a folder, Spectra Code scans all supported manifest files, fetches the relevant analysis data, and displays results in the activity bar and under the Problems tab. Each detected issue (warning or fail) is underlined in the manifest file. Saving changes to a manifest file triggers a new analysis.

Hover over a problematic dependency version in its manifest file to view its Spectra Code assessment summary, package information, and a link to its report on the Community page. The hover window also provides the following options:

• View problem - opens a pop-up showing the total number and types of issues detected for the selected dependency version, and lets you switch between other flagged dependencies in the same manifest file
• Quick fix - opens a pop-up listing available versions for the dependency, with issue information for each, so you can select one to update to. This option is also available from the Problems tab: right-click an issue and select Quick fix to view available versions

Tip: By default, VS Code opens files in the currently focused tab group, even if the file is already open elsewhere. If you'd rather it reveal the already-open tab instead, set workbench.editor.revealIfOpen to true in your VS Code settings.

RL view

Spectra Code provides the RL view to navigate problematic dependencies in your projects, accessed via the RL icon at the bottom of the left-hand sidebar. It shows only files containing issues identified by Spectra Code.

The RL view lists vulnerable dependencies by manifest file and SAFE Assessment category: Malware, Tampering, Vulnerabilities, Secrets, Hardening, and Licenses. An additional Unknown category covers packages that have no assessment available, typically because the package version has since been removed or unpublished from its source registry.

For each manifest file, the RL view shows a summary of how many assessment categories are failing. Selecting a dependency opens its manifest file and positions the cursor on that dependency.

To reduce noise in larger projects, specific risk categories (Vulnerabilities, Hardening, Secrets, Licenses) can be disabled in rl-profile configuration, preventing issues in those categories from being detected or reported. The profile is located at project/.rl-protect/rl-profile.json and is applied on the project level. Each project has its own profile, whether it's one of several in the same workspace or in a separate workspace entirely.

Commands

To run Spectra Code commands, open the Command Palette (Ctrl+Shift+P), type Spectra Code, and select the desired command.

Privacy notes

Your Spectra Code token is encrypted and stored securely in VS Code, so you only need to enter it once. It is never shared with other extensions.

Whether you use a Community Free or Portal Enterprise token, it is displayed only once in the Community or Portal UI when generated. Copy and store it somewhere safe, as it cannot be viewed again afterward.

Your token is used only for:

• connecting to the Community API or Portal API, depending on your token type
• tracking your monthly API usage

Analysis data is refreshed hourly while VS Code is open, and each API refresh consumes part of your monthly API quota. Larger projects generate more API calls and use more quota accordingly.

Uninstalling or disabling the extension does not automatically revoke or delete your token. If you want to fully invalidate it, first delete it by using the Delete user token command and then revoke it from your Community or Portal profile.

Useful resources

• Check out the official Spectra Assure Community page.
• Look at the API usage tiers guide to learn more about each tier and how to upgrade.
• Read a more detailed guide on the Spectra Code extension in the Spectra Assure Community documentation.