Deva Security

In-editor security scanning, AI-assisted fixes, and compliance mapping for VS Code, Cursor, Windsurf, and other VS Code-compatible editors.

Architecture

This repository is the editor client. It does not contain a scanner, rulepacks, compliance seeds, exporters, validation prompts, or provider implementations. Those capabilities are owned by DevSecCode Core and exposed through Core's authenticated local /v1 API.

The extension is responsible for:

• editor commands, diagnostics, trees, webviews, and fix previews;
• DevSecCode sign-in, billing UI, and signed-entitlement acquisition;
• downloading and verifying the pinned signed Core artifact;
• endpoint discovery, process lifecycle, bearer authentication, and capability checks;
• mapping Core responses into VS Code presentation models.

Core is responsible for:

• workspace, file, and realtime scanning;
• rule and compliance framework data;
• compliance evaluation and exports;
• finding validation, explanation, fix generation, redaction, and provider routing;
• local model discovery and installation.

What it does

• Scan — Run Core's SAST engine and show findings as native VS Code diagnostics.
• Map — Evaluate findings against the compliance frameworks advertised by Core.
• Validate and fix — Ask Core to validate findings or generate a suggested fix using local, BYOK, or Core Cloud providers.
• Export — Request SARIF, JUnit, agent JSON, and OSCAL Assessment Results from the completed Core scan.

First run and trust model

First run does not require sign-in. The extension offers to download the signed Core artifact, starts it anonymously, and enables standard local file, workspace, and realtime scans plus SARIF. Signing in allows the extension to transport a short-lived Ed25519-signed v2 entitlement; Core verifies it and unlocks only the explicitly granted product capabilities. Missing, expired, or revoked paid access downgrades to Free without stopping Core.

Advanced scan controls, compliance, advanced exports, evidence, dependency and SBOM analysis, local/BYOK/frontier model orchestration, and remediation require Individual or higher as reported by Core. Team, Business, and Enterprise add their inherited organization capabilities. The full-core artifact profile describes what the signed binary contains; it is not a plan.

The extension pins Core 0.3.6 with the full-core profile. Official VSIX releases embed the immutable Core artifact-feed URL only after the release workflow verifies the signed manifest and every supported platform archive. Source builds intentionally have no default feed; set deva.core.artifactBaseUrl when testing a staged release.

The Deva CLI uses the same signed artifact format and trust key, but packages one host-specific Core archive inside the CLI application. A working CLI installation therefore does not imply that a public standalone Core feed exists.

The manifest signature is verified against the public key pinned in the VSIX before any manifest field or archive filename is trusted. The selected archive is then checked for its signed size and SHA-256 digest before extraction. Core is cached under the extension's VS Code global storage.

Release artifacts are currently expected for macOS arm64, glibc-based Linux x64 at glibc 2.28 or newer, and Windows x64—the production matrix built and signed by Core. The extension verifies the Linux host's libc and version from the remote Extension Host before downloading or launching Core. Alpine/musl, older glibc, unknown libc, and Linux ARM fail closed with an actionable unsupported-runtime error. Additional libc or architecture combinations must first become Core-owned release targets.

LLM modes

All scanner-bound LLM work goes through Core:

BYOK keys are stored in VS Code SecretStorage and supplied only to the Core process started by this extension. They are never written to workspace settings.

Static scanning and paid compliance evaluation run locally. Network access is needed for the first Core download, online sign-in/entitlement refresh, local-model installation, and any selected cloud LLM provider. Once Core is acquired, Free scans continue offline indefinitely.

Development

Place DevSecCode-EXT and DevSecCode-Core beside each other, bootstrap Core's .venv, then run:

npm ci
npm run test:core-boundary
npm run test:unit
npm run test:core-integration
npm run build

For the standalone extension gate, including VSIX content auditing, run npm run verify. The pinned reference Linux environment runs the same gate:

docker build --platform linux/amd64 \
  --file .devcontainer/Dockerfile --target verify .

The reference platform is Linux x64, matching Ubuntu CI and Core's current Linux release target. Docker Desktop uses emulation on ARM development hosts. The Dev Container configuration uses the same Dockerfile and installs the lockfile with npm ci. Source integration with an adjacent Core checkout remains a separate contract test; installed extensions continue to acquire a signed native Core artifact.

The Extension Development Host starts Core from the adjacent source checkout. Set deva.core.sourcePath or DEVSECCODE_CORE_ROOT when the repositories are elsewhere. Installed extensions always require a compatible full-core artifact unless deva.core.binaryPath is explicitly configured.

License

Proprietary. Use is governed by the Deva Security End User License Agreement in LICENSE.txt. Copyright (c) DevSecCode, Inc. All rights reserved.