Auric Code Health — Secrets, TODOs & Risk

A language-agnostic hygiene scanner for every file in your repo — hardcoded secrets, injection and TLS-bypass patterns, debug leftovers, merge markers, TODOs, and oversized files. Exports health.json + SARIF 2.1.0 and ships a CLI for CI. Entirely local.

Auric Code Health reads source text with argument-aware structured analysis (no AST, no git-history scan, no dependency), so it favours precision — it catches the common, high-confidence cases and tells a constant from a dynamic value. It runs on every language, and the exact same engine powers the auric-artisan CLI, so your editor findings and your CI gate agree down to the fingerprint.

Every detector now has a stable fine-grained rule identity, detector version, confidence, automation method, remediation, and requirement/source links. Possible secret evidence is redacted before it reaches reports, SARIF, Studio, or history.

Features

Seven hygiene categories

• Possible secrets — 20 built-in detectors (AWS, GitHub, GitLab, OpenAI, Anthropic, npm, SendGrid, Slack/Discord webhooks, Stripe…), private-key blocks, JWTs, and credentials embedded in connection URLs — filtered by placeholder/env heuristics and a Shannon-entropy confidence level, and extensible with your own regexes.
• Security footguns — command injection (exec built from a dynamic value) and SQL injection (interpolated/concatenated queries), disabled TLS verification, weak crypto (MD5/SHA-1), unsafe deserialization (pickle/yaml.load/unserialize), XSS sinks (innerHTML =, v-html, insertAdjacentHTML), and wildcard CORS.
• Risky APIs, debug leftovers, merge-conflict markers, TODO/FIXME task markers, and oversized files.

Because it's argument-aware, eval('use strict') and el.innerHTML = '<b>static</b>' are downgraded or ignored, while eval(userInput) and el.innerHTML = userHtml are flagged as high-confidence sinks — signal, not noise. Findings surface inline (Problems panel) and in the project report; toggle each category under auricCodeHealth.codeHealth.*.

Code Health Studio

Open Code Health Studio for the dedicated health score and grade, all seven category counts, confidence-aware findings, category/confidence/text filters, and direct actions for re-scanning, the project report, health.json + SARIF, the local data folder, and the remediation plan. When other Auric apps are installed this tab appears inside the elected Workstation's union Studio.

Searchable Code Health rulebook

The local Knowledge Base maps the fine-grained signatures into a searchable Code Health rulebook with evidence/confidence policy, suppression governance, secret-response guidance, glossary terms, and official OWASP/CWE/NIST provenance. Generate knowledge.json + rulebook.md for the workspace and optionally add validated team guidance in knowledge-overrides.json.

Health records for CI — health.json, SARIF, history

Write Health Record persists a stable, versioned record to .auric-artisan/:

• health.json — a schema'd record (overall / contrast / accessibility / code-health scores + grade, counts by source/severity/category), with a unified issues[] where every finding carries a stable FNV-1a fingerprint, path, line/col, message, and fix — deterministic and diff-friendly for baselines.
• health.sarif — SARIF 2.1.0 (rules + results + levels + fingerprints) for GitHub code scanning; findings appear inline on the PR diff.
• health-history.json — an append-only, capped trend log.

A unified project report

Generate Project Health Report opens one Markdown + JSON report spanning colour, accessibility, and code health — grade, languages, category chips, and worst findings — generated entirely locally.

The auric-artisan CLI (shipped with this extension)

The same engine, headless and network-free, for pull-request gates:

# one-time: freeze existing findings on a legacy repo
auric-artisan scan . --write-baseline .auric/baseline.json

# on every PR: fail only on NEW issues, emit SARIF for the diff
auric-artisan scan . --baseline .auric/baseline.json --max-new 0 --sarif auric.sarif

Flags include --json, --sarif, --baseline / --write-baseline, --fail-on high|medium|low, --max-new <n>, --min-score <n>, --profile, --threshold, --no-code-health, --max-files <n>, and --quiet. Exit codes: 0 pass · 1 policy violation · 2 error. It respects .auricignore and reports truncation honestly.

Agent-ready remediation plan

Generate Agent-Ready Remediation Plan writes a deterministic, local Markdown + JSON backlog to .auric-artisan/ai-remediation-plan.* — a remediation task list plus a prompt template you can hand to a coding agent you bring. No model call, no network.

Code Health is a high-signal heuristic linter, not a full SAST or secret scanner. Use it alongside — not instead of — a dedicated tool for compliance.

In practice

Commands

All commands are listed in the palette under the Auric Artisan category.

Keybindings

Settings

A representative subset — there are 28 settings under the auricCodeHealth. namespace (open Settings and search auricCodeHealth).

Part of the Auric Artisan Workstation

Installed on its own, Auric Code Health is a complete product with an Overview home and a dedicated Code Health Studio for filtering and acting on the full report.

Install it alongside Auric Accessibility and/or Auric Color and the three cooperate automatically. The suite elects a single Workstation host (priority Accessibility → Color → Code Health); with a sibling present, Code Health contributes its Code Health tab, hygiene score, findings, and actions into that host's capability-aware Studio and Command Center instead of showing a second dashboard, and its diagnostics keep running as the single owner of code-health analysis. The election updates live on install/uninstall, no reload.

Privacy

Everything runs locally. Auric Code Health sends no source code, scan results, or telemetry to any server — the no-network guarantee is mechanically enforced against the shipped build, and the CLI runs the same way. Health records and the remediation plan are written only to the workspace .auric-artisan/ folder. No account, no API key, no paid tier.

Requirements

• VS Code 1.74 or newer. Works in single-folder and multi-root workspaces.

By Auric Artisan · auricartisan.com