Sec1 Security: SCA & SAST

Find vulnerable open-source dependencies, insecure code and hard-coded secrets while you work in Visual Studio Code. Sec1 scans your workspace when you open it and whenever you save, and shows each issue in the line where it occurs, with the information you need to fix it.

Preview release. This extension is in preview. Features and settings may change before general availability. We welcome your feedback at sec1.io/contact-us.

Features

Software Composition Analysis (SCA)

Detects known vulnerabilities (CVEs) in open-source dependencies.
Reads lockfiles and manifests for npm, Yarn, pnpm, pip, Pipenv, Poetry, Go modules, Cargo, Bundler, Composer, Maven, Gradle, NuGet, Conan and vcpkg.
Identifies vendored C/C++ libraries copied into your repository or linked into prebuilt binaries, such as OpenSSL, zlib, curl, cJSON and STM32 HAL. Package-manager-based scanners usually miss these.
Shows severity, CVSS score, EPSS probability, CISA Known Exploited Vulnerabilities (KEV) status and the recommended fixed version for each vulnerable package.
Offers a one-click upgrade for requirements.txt and go.mod.

Static Application Security Testing (SAST)

Finds security flaws in your source code, such as SQL injection, command injection and path traversal, using the same Sec1 engine as Sec1's CI/CD integrations.
Shows whether user-controlled input reaches the vulnerable code, for example "reachable from an HTTP endpoint".
Analysis runs on your machine. Your source code is not uploaded.

Secrets detection

Flags hard-coded credentials such as cloud access keys, tokens, private keys and passwords.
Never displays the secret value itself.

Requirements

Visual Studio Code 1.85 or later.
A Sec1 account and API key.
An active Sec1 subscription for each capability:

Capability Subscription

Dependency scanning (SCA) Sec1 SCA

Code and secrets scanning (SAST) Sec1 SAST

If your plan doesn't include a capability, the extension skips it and the status bar explains why.
An internet connection. Dependency results are matched against the Sec1 vulnerability database, and Sec1 confirms your subscription before scanning.

Getting started

Sign in at account.sec1.io. Open the profile menu (top right) → Settings → API key → Generate API key, and copy the key.
In VS Code, open the Command Palette (Ctrl+Shift+P / ⇧⌘P) and run Sec1: Sign In with API Token. Paste the key.
Open a project folder. The first scan starts automatically.

The API key is stored in your operating system's credential store (macOS Keychain, Windows Credential Manager or the Linux Secret Service). It is never written to settings or project files.

Viewing results

Where	What you see
Editor	Underlined issues. Hover for details: severity, CVSS, EPSS, KEV, fixed version and references.
Problems panel	All findings. Type `Sec1 SCA`, `Sec1 SAST` or `Sec1 Secrets` in the filter box to narrow them down.
Sec1 Security view (activity bar)	Findings grouped by Open Source (SCA), Code (SAST) and Secrets.
Status bar	Scan progress and a summary of findings. A warning icon means a scan failed or was skipped; hover for the reason.

Fixing and suppressing findings

Place the cursor on a finding and press Ctrl+. (⌘. on macOS):

Sec1: upgrade package to version updates requirements.txt or go.mod to the fixed version. For lockfiles, upgrade with your package manager so the lockfile stays consistent.
Sec1: ignore … records the decision, with a reason, in a .sec1ignore file at the root of the workspace. Commit this file to share the decision with your team. Entries can expire:
```
CVE-2022-37434 third_party/zlib/ expires=2026-12-31  # inflate() is not used
```
Sec1: suppress rule on this line adds a sec1-ignore comment for a single code finding.

Findings marked as risk accepted in the Sec1 dashboard are hidden automatically.

When scans run

Trigger	Dependencies (SCA)	Code and secrets (SAST)
Opening a workspace	Scanned. Recent results are reused if dependencies haven't changed.	Scanned
Saving a dependency file	Rescanned when packages or versions change	As for any other save
Saving any other file	—	Rescanned if the content changed, at most once every 30 seconds
Sec1: Scan Workspace	Rescanned	Rescanned

Data handling

Dependency scanning sends only package names and versions, as a CycloneDX software bill of materials (SBOM). Results are shown in your editor. Depending on your Sec1 instance, a scan may also appear as a report in your Sec1 dashboard; Sec1: Open Report on Dashboard opens it.
Code and secrets scanning runs locally. Results stay in your editor.
Repository URLs are stripped of embedded credentials before use.
In Restricted Mode (an untrusted workspace), the extension uses only its bundled, checksum-verified scanning engine and ignores workspace-defined engine settings.

Commands

Command	Description
Sec1: Sign In with API Token	Store your Sec1 API key
Sec1: Sign Out	Remove the stored API key
Sec1: Scan Workspace	Run a full scan now
Sec1: Open Report on Dashboard	Open the latest dependency report in the Sec1 dashboard, when the scan created one
Sec1: Show Status	Show the signed-in account, subscriptions and last scan results
Sec1: Show Log	Open the extension log

Settings

Setting	Default	Description
`sec1.minSeverity`	`low`	Hide findings below this severity. Secrets are always shown.
`sec1.scanOnStartup`	`true`	Scan when a workspace opens.
`sec1.scanOnSave`	`true`	Rescan after saving a file.
`sec1.exclude`	`[]`	Workspace-relative paths to skip, for example `fixtures/`.
`sec1.sca.enabled`	`true`	Enable dependency scanning.
`sec1.sast.enabled`	`true`	Enable code and secrets scanning.
`sec1.sast.timeoutMinutes`	`15`	Stop a code scan that runs longer than this.
`sec1.sast.minIntervalSeconds`	`30`	Minimum time between code scans triggered by saving.
`sec1.proxy`		Proxy URL. Defaults to `HTTPS_PROXY` / `NO_PROXY`.
`sec1.caCertPath`		PEM file with additional root certificates, for example for TLS inspection.
`sec1.baseUrl`	`https://api.sec1.io`	Sec1 API URL. Change only for on-premises installations.
`sec1.dashboardUrl`	`https://unified.sec1.io`	Sec1 dashboard URL for on-premises installations.

Connection settings (sec1.baseUrl, sec1.dashboardUrl, sec1.proxy, sec1.caCertPath) can be set only in user or machine settings, so a project's settings can't redirect your credentials.

Supported platforms

Windows (x64), macOS (Apple silicon and Intel) and Linux (x64 and Arm64, including Alpine). On Windows on Arm, only dependency scanning is available in this release.

Support

Product information: sec1.io
Contact and support: sec1.io/contact-us

When reporting a problem, include the output of Sec1: Show Status and Sec1: Show Log. Neither contains your API key.

License

Apache License 2.0. The bundled Sec1 SAST engine is licensed separately.