Buggers — Security & Code Review

Deterministic In-Editor SAST, Secret Leak Prevention, and Pull Request Triage for Visual Studio Code.
Official Extension · Platform: https://buggers.dev · Documentation: https://buggers.dev/docs

📖 Overview

Buggers for VS Code brings the precision of Buggers' cloud release intelligence directly into your everyday developer workflow. It continuously inspects your code locally in-process to catch OWASP Top 10 vulnerabilities, code quality risks, and accidental secret exposures before you ever commit or open a pull request.

Whether you're developing backend APIs, smart contracts, microservices, or frontend web applications, Buggers provides deterministic security audits with zero telemetry and zero code exfiltration.

✨ Features

• 🛡️ In-Editor Security Flaw Detection: Deterministically flags high-impact OWASP Top 10 vulnerabilities (SQL Injection, Command Injection, SSRF, Path Traversal, Insecure CORS, Side-Channel Timing Attacks, Weak Cryptography, and Eval Injection).
• 🔑 Real-Time Secret Leak Prevention: Prevents accidental credential leaks by detecting unencrypted AWS Access Keys, GitHub PATs, OpenAI API keys, Stripe Secret Keys, Private Key blocks, and Database Connection URIs before code is committed or pushed.
• 📋 Native VS Code Diagnostics: Flaws and secrets are populated into VS Code's native Problems panel (Ctrl+Shift+M / Cmd+Shift+M) with precise line and column highlighting.
• 🌳 Buggers Activity Bar View: Dedicated sidebar view container grouping findings by Severity (CRITICAL, HIGH, MEDIUM, LOW) with 1-click jump to file and line.
• 🔒 Zero-Trust Privacy & Data Isolation: Scans files locally in-process without transmitting source code to external servers. Credentials and tokens are stored securely in the OS keychain via vscode.ExtensionContext.secrets.
• ⚡ Auto-Scan on Save: Automatically verifies open documents upon saving, giving you continuous security feedback while you code.

⚡ Quick Start

1. Install Buggers from the VS Code Extensions panel (Ctrl+Shift+X ➔ search Buggers).
2. Open any project workspace containing JavaScript, TypeScript, Python, Go, or configuration files.
3. Save any file or press Ctrl+Shift+P and run:

   Buggers: Analyze Current File
   

4. View detected security issues and masked secrets directly in the Problems tab or open the Buggers shield icon on the Activity Bar.

🔒 Privacy & Data Isolation Statement

Buggers is designed with a strict local-first, zero-trust architecture:

1. Local In-Process Scanning: All SAST rules and secret-detection patterns run entirely within your local VS Code process. Your source code, file contents, file paths, and project structure are never transmitted to any remote server or third-party service during analysis.
2. Zero Telemetry / Zero Trackers: The extension contains no analytics trackers, advertising beacons, or background data collection.
3. Secure Credential Storage: Any API tokens or GitHub PATs you provide are stored exclusively in your operating system's native secure credential store (e.g. Windows Credential Manager, macOS Keychain, or Linux Secret Service via vscode.ExtensionContext.secrets). They are never stored in plaintext settings, configuration files, or logs.
4. Outbound Requests: The extension only initiates an outbound network action when you explicitly execute Buggers: Open Buggers Dashboard, which opens your configured dashboard URL in your system's default web browser.

🚀 Available Commands

Access all commands via the Command Palette (Ctrl+Shift+P on Windows/Linux, Cmd+Shift+P on macOS):

⚙️ Configuration Settings

Configure in VS Code Settings (Ctrl+, / Cmd+,) under Extensions > Buggers:

🛡️ Supported SAST & Secret Rules

Security Vulnerabilities (SAST)

• sql_injection (Critical): Detects dynamic SQL queries constructed via string concatenation or template literals.
• command_injection (Critical): Detects unsanitized user inputs passed to child_process.exec or shell invocations.
• insecure_eval (Critical): Detects dangerous dynamic code evaluation via eval() or new Function().
• ssrf (High): Flags unvalidated dynamic URLs passed directly to fetch(), axios, or http.get.
• path_traversal (High): Detects unvalidated path concatenation in filesystem operations (fs.readFile, etc.).
• timing_attack (High): Identifies non-constant-time equality operators (===) comparing sensitive tokens or hashes.
• insecure_cors (Medium): Detects wildcard Access-Control-Allow-Origin: * headers with credentials: true.
• weak_crypto_hash (Medium): Identifies legacy cryptographic hashes (MD5, SHA1) used in security contexts.

Secret Detection

• aws_access_key (Critical): AWS Access Key IDs (AKIA[0-9A-Z]{16}).
• github_pat (Critical): GitHub Personal Access Tokens (ghp_[A-Za-z0-9_]{36}, github_pat_...).
• openai_api_key (Critical): OpenAI API Keys (sk-proj-..., sk-...).
• stripe_secret_key (Critical): Stripe Secret API Keys (sk_live_[0-9a-zA-Z]{24}).
• private_key (Critical): Unencrypted RSA / EC / OpenSSH Private Key headers.
• db_connection_uri (Critical): Database connection strings containing embedded credentials.

Note: The scanner automatically masks discovered secrets in all evidence displays to prevent secondary leaks.

📦 Local Installation

To install the packaged extension file (.vsix) in VS Code:

1. Open the Extensions view (Ctrl+Shift+X or Cmd+Shift+X).
2. Click the ... (More Actions) menu at the top right of the Extensions view.
3. Select Install from VSIX....
4. Choose the buggers-vscode-1.0.0.vsix package file.

Alternatively, via the command line:

code --install-extension buggers-vscode-1.0.0.vsix

🛠️ Building & Packaging from Source

# Navigate to extension directory
cd extensions/buggers-vscode

# Install development dependencies
npm install

# Compile TypeScript
npm run compile

# Bundle extension with esbuild
npm run build

# Run comprehensive test suite
npm test

# Package VSIX archive
npm run package

📄 License

Proprietary & All Rights Reserved. See LICENSE for details. Copyright © 2026 Jaidev Yadav. All Rights Reserved.