XploitScan for VS Code

Security scanner for AI-generated code, right inside your editor, tuned for what Cursor, Lovable, Bolt, Replit, and Claude Code actually produce — unprotected Stripe webhooks, hardcoded API keys, SQL injection via template literals, missing auth middleware, CORS misconfigurations, and more.

	Rules	What you need
Free	30	Nothing. No account, no network.
Pro	all 223	An API key from a paid XploitScan plan: Indie, Pro or Team, including a Pro or Team free trial (pricing)

The status bar always says which one you're on: XploitScan: Free — 30 rules or XploitScan: Pro — 223 rules.

Either way your code is scanned locally and never uploaded.

Features

Scan on save — every time you save a file, XploitScan checks it for vulnerabilities and surfaces findings in the Problems panel
Status bar indicator — at-a-glance count of issues in the current file, color-coded by severity, next to the plan you're scanning with
Rule documentation — each finding links to the rule's full explanation at xploitscan.com/rules
Configurable noise floor — filter out low-severity findings if you only want to see critical and high issues
Works offline — the free rules are bundled with the extension. On a paid plan, the downloaded Pro rules keep working offline too (see below)

Getting started

Install the extension
Open any JavaScript, TypeScript, or Python file
Save — XploitScan runs automatically
Check the Problems panel (Cmd+Shift+M / Ctrl+Shift+M) for findings

You can also run scans on demand:

XploitScan: Scan Current File — rescan whatever's in the editor
XploitScan: Scan Workspace — scan every open document (for full-repo scans, use the CLI: npx xploitscan@1.17.0 scan .)
XploitScan: Clear Diagnostics — dismiss all findings
XploitScan: Enter API Key — unlock all 223 rules with a paid plan's key
XploitScan: Remove API Key — go back to the 30 free rules
XploitScan: Show Plan — which rules are running, and why

All commands are in the command palette (Cmd+Shift+P / Ctrl+Shift+P).

Unlocking all 223 rules

API keys are a paid-plan feature. On Indie, Pro, or Team (see pricing):

Create a key at xploitscan.com → Settings → API Keys. Keys start with xpls_.
Run XploitScan: Enter API Key and paste it.
The status bar changes to XploitScan: Pro — 223 rules.

What happens with the key:

It is kept in VS Code's encrypted secret storage, never in settings.json.
The extension sends it to xploitscan.com to check your plan, then downloads the Pro rules and runs them locally. Your code is not sent.
The downloaded rules are cached and re-downloaded once a day. If xploitscan.com can't be reached, the cached rules keep working until they are 7 days old.
If the key is revoked, or your plan doesn't include the Pro rules, the extension goes back to the 30 free rules and tells you why.

Settings

Setting	Default	Purpose
`xploitscan.scanOnSave`	`true`	Auto-scan when a file is saved
`xploitscan.scanOnOpen`	`false`	Auto-scan when a file is opened
`xploitscan.severityThreshold`	`low`	Hide findings below this severity
`xploitscan.showStatusBar`	`true`	Show the XploitScan indicators in the status bar
`xploitscan.apiBaseUrl`	`https://xploitscan.com`	Where plan checks and Pro rule downloads go. User settings only; must be https

What gets flagged

A few examples of what the extension's free rules catch:

Stripe webhook handlers without signature verification
Hardcoded API keys and JWT secrets
SQL injection via template literals (db.query(`SELECT ... ${x}`)) — the default pattern AI tools produce
dangerouslySetInnerHTML fed URL query params or localStorage
eval() and the Function constructor
Next.js API routes without auth middleware
CORS wildcards
Open redirects via res.redirect(req.query.x)

With a paid plan's API key the extension runs 193 more: service-specific keys, Clerk, GitHub and Slack webhooks, command injection, missing request validation, and the rest of the catalog.

All 223 rules are documented at xploitscan.com/rules with OWASP and CWE mappings.

Privacy

Every scan runs locally inside VS Code's extension host. Source code never leaves your machine. No telemetry. Without an API key the extension makes no network requests at all; with one, it only checks your plan and downloads the Pro rules from xploitscan.com. Full privacy policy.

CLI — npx xploitscan@1.17.0 scan . for full-repo scans from the terminal
GitHub Action — marketplace listing for CI
MCP server — xploitscan-mcp on npm for Claude Desktop / Cursor agents
Web scanner — xploitscan.com/scan for upload-and-scan flow

Same rule engine across all surfaces: the free tier runs the same 30 rules everywhere, and paid plans run all 223 in this extension, the CLI, the GitHub App and the web scanner.

License

MIT.

XploitScan Security Scanner

XploitScan