AuditX for Visual Studio Code 🛡️
AuditX is a modular security auditing platform and DevSecOps assistant for developers. It brings deep static analysis (SAST), secret scanning, custom regex rules, and AI-powered remediation directly into your Visual Studio Code editor.
🌟 Key Features
- 🔍 Instant Security Scanning: Run full repository audits with one click or command (
AuditX: Run Security Scan).
- 🛑 Direct IDE Diagnostics: View all vulnerabilities, exposed API keys, and code flaws directly inside your VS Code Problems Panel with precise line and column markers.
- ✨ AI Vulnerability Explanations: Understand the root cause and attack impact with
AuditX: AI Explain Finding.
- 🛠️ AI Fix Suggestions & Diffs: Generate secure replacement code and unified diffs directly in your editor.
- 🪝 Shift-Left Pre-Commit Protection: Integrates with AuditX CLI pre-commit hooks to block dangerous commits before code leaves your local environment.
🚀 Getting Started
1. Requirements
The AuditX CLI runner is bundled with this extension.
AuditX can use bundled scanner binaries from the extension's tools/ directory. If a bundled scanner is not present for your platform, AuditX falls back to the scanner command from your system PATH.
Optional scanner commands:
semgrep
trivy
gitleaks
npm
2. Available Commands
Open the VS Code Command Palette (Ctrl+Shift+P or Cmd+Shift+P on macOS) and run:
| Command |
Description |
AuditX: Scan |
Runs the same workspace security scan with a shorter command name. |
AuditX: Run Security Scan |
Runs AuditX multi-scanner audit on the current workspace and populates the Problems panel. |
AuditX: AI Explain Finding |
Opens an AI-powered breakdown of the security vulnerability at your cursor position. |
AuditX: AI Suggest Fix |
Generates a drop-in replacement code fix with side-by-side review. |
⚙️ Configuration
AuditX automatically discovers auditx.config.json in your workspace root. You can configure custom policy rules:
{
"version": 1,
"scanners": {
"gitleaks": true,
"semgrep": true,
"customRules": true
},
"policy": {
"blockOn": ["CRITICAL"]
}
}
📄 License
MIT License. Developed for open-source and enterprise DevSecOps teams.
