Dotguard for VS Code

Dotguard finds unsafe, incomplete, and undocumented environment configuration while you work. The extension is self-contained: install it, open a trusted project containing an environment file, and scan—no Python or separate CLI required.

Environment values are never included in diagnostics, finding details, notifications, or network requests.

Highlights

Scan .env immediately; .env.example is optional and enables contract comparison when present.
Detect empty secrets, placeholders, common defaults, reused values, and provider-shaped credentials.
Find undocumented environment references and hard-coded sensitive literals in supported source files.
Check Git protection, Dockerfiles, and Compose configuration.
Check exact Python dependency pins against OSV after explicit consent.
Normalize GHSA and PYSEC advisories to canonical CVE identifiers when aliases exist.
Review findings in Problems, the Dotguard Activity Bar view, and rule-specific detail panels.
Apply conservative Quick Fixes without copying or inventing secret values.

Getting started

Install Dotguard and open a trusted workspace.
Select the Dotguard shield in the Activity Bar.
Run Dotguard: Scan Workspace or click the status-bar item.
Select a finding for impact and remediation guidance.

Dotguard automatically detects standard pairs such as .env/.env.example and named pairs such as .env.test/.env.test.example. If no example exists, standalone safety, Git, source, deployment, and dependency checks still run.

What Dotguard checks

Area	Examples
Environment contract	Missing and undocumented keys
Values	Empty secrets, placeholders, defaults, short or reused credentials
Git	Tracked, staged, or unignored environment files
Source	Environment references, hard-coded credentials, unresolved placeholders
Production profile	Debug mode, auth bypass, disabled TLS, wildcard origins, local or HTTP endpoints
Containers	Dockerfile secrets, copied `.env`, root execution, Compose literals
Dependencies	Known OSV advisories for exact `requirements*.txt` pins

See the complete rule reference.

Safe remediation

Current Quick Fixes can:

add an empty missing key declaration;
document a key without copying its local value;
replace a Compose secret literal with ${VARIABLE_NAME};
remove an environment-file COPY instruction;
add .env to .dockerignore.

Dotguard does not guess credential values, silently upgrade dependencies, or make ambiguous security changes.

CVE lookup and privacy

When a pinned requirements*.txt file is present, Dotguard asks before enabling OSV lookups. Only ecosystem, package name, exact version, and advisory identifier are sent to api.osv.dev. Environment values, source code, filenames, paths, Git data, and identity remain local.

Results are cached only in memory. Disable lookups at any time:

{
  "dotguard.cveScan": "disabled"
}

Read the complete privacy disclosure.

Settings

Setting	Default	Purpose
`dotguard.engine`	`embedded`	Use the bundled scanner or optional external CLI.
`dotguard.envFile`	`.env`	Environment path relative to each workspace folder.
`dotguard.exampleFile`	`.env.example`	Optional contract path.
`dotguard.profile`	`project`	Use project, default, or production checks.
`dotguard.scanSource`	`true`	Scan supported source and deployment files.
`dotguard.cveScan`	`prompt`	Prompt, enable, or disable OSV lookup.
`dotguard.scanOnOpen`	`true`	Scan trusted projects automatically.
`dotguard.scanOnSave`	`true`	Rescan relevant changes.

Security boundaries

Dotguard is a preventative configuration tool, not proof that a project is secure. It does not determine whether a credential is active or compromised, and an OSV record does not prove exploitability in a particular application. Review SECURITY.md before relying on findings in a deployment process.

Support and development

Development commands:

npm ci
npm test
npm run check
npm run package:vsix

Dotguard

Vengeance Labs