Onlock Security Copilot

Onlock Security Copilot helps you catch risky code in VS Code before it reaches review. It scans the current file as you type or save, highlights suspicious lines, explains the issue in plain language, and suggests a safer fix.

What It Does

• Scans the current file automatically while you work
• Highlights risky lines and adds editor diagnostics
• Explains findings in plain language
• Suggests safer code you can review and apply

How To Use It

1. Install the extension.
2. Open a code file in VS Code.
3. Type or save to run a scan.
4. Open a finding to read the explanation and review the suggested fix.

What It Commonly Flags

• SQL injection
• Command injection
• Hardcoded secrets
• Unsafe eval or exec
• Path traversal
• XSS, SSRF, and open redirects

Important Notes

• The extension uses the hosted Onlock API for scanning, explanations, and fix suggestions.
• The first request can be slow if the hosted service is waking up.
• Review suggested fixes before applying them.

Support

• Source: https://github.com/Runningbird20/developer-security-copilot
• Issues: https://github.com/Runningbird20/developer-security-copilot/issues