AI-powered SAST vulnerability auto-fix using AWS Bedrock and Claude. Reads WIZ SAST CSV reports and automatically fixes security vulnerabilities across Java, Python, TypeScript, React, Angular and .NET.
Features
- Auto-Fix: Reads a WIZ SAST CSV report, calls AWS Bedrock (Claude), and applies patches directly to your source files.
- Dry Run: Preview the proposed fixes before applying anything.
- Git Workflow: Optionally creates a branch, commits, and pushes the fixes automatically.
- Multi-language: Java, Python, TypeScript, React, Angular, .NET.
- Severity Filter: Process only HIGH, MEDIUM, or LOW findings — configurable.
Requirements
- VS Code 1.74+
- Python 3.8+ with
pip
- AWS account with Bedrock access (Claude model enabled)
- A WIZ SAST CSV report
Getting Started
Install Python dependencies
Open the Command Palette (Ctrl+Shift+P) and run:
SAST: Install Python Dependencies
Configure AWS credentials
Run:
SAST: Configure AWS Credentials
Enter your AWS Access Key ID and Secret Access Key. Credentials are stored securely in VS Code SecretStorage and never written to disk.
Run Auto-Fix
- Right-click a
.csv WIZ SAST report in the Explorer and choose SAST: Run Auto-Fix (Apply + Git).
- Or open the Command Palette and run
SAST: Run Auto-Fix (Apply + Git).
Dry Run (preview only)
Right-click the CSV and choose SAST: Dry Run (Preview Only) to see the proposed fixes without modifying files.
Extension Settings
| Setting |
Default |
Description |
sast.pythonPath |
python |
Path to the Python 3 executable |
sast.awsRegion |
us-east-1 |
AWS region for Bedrock |
sast.bedrockModel |
us.anthropic.claude-sonnet-4-5-20250929-v1:0 |
Bedrock model ID |
sast.autoGit |
true |
Auto-create branch, commit, and push after fix |
sast.severityFilter |
["HIGH","MEDIUM","LOW"] |
Severities to process |
Commands
| Command |
Description |
SAST: Run Auto-Fix (Apply + Git) |
Fix vulnerabilities and commit |
SAST: Dry Run (Preview Only) |
Preview fixes without applying |
SAST: Configure AWS Credentials |
Store AWS credentials securely |
SAST: Install Python Dependencies |
Install required Python packages |
License
See LICENSE.txt for details.
| |
