Deva Security
Find security vulnerabilities in your code while you write it. Deva scans on your machine, free and with no account, in VS Code, Cursor, Windsurf and other VS Code-compatible editors.
What Deva does
- Scans your code for vulnerabilities such as SQL injection, cross-site scripting, command injection, path traversal, weak cryptography and hardcoded secrets. Findings link to their CWE entries.
- Checks code as it changes. Unsaved edits are checked as you type, and saved files are re-checked when anything changes them, including git, terminals and AI coding agents.
- Checks your dependencies against OSV advisories.
- Keeps noise down. Suppress a finding with a recorded reason, and look up any rule in the rule catalog.
- With Pro, validates findings and suggests fixes using a local model or your own API key, maps findings to compliance frameworks such as NIST 800-53, PCI DSS, SOC 2 and OWASP Top 10, and exports SARIF, SBOMs, OSCAL and signed evidence.
Quick start
- Install Deva Security from the Extensions view, or run
ext install devseccode.deva-security from Quick Open (Ctrl+P, or Cmd+P on macOS).
- Open a project folder.
- Run Deva: Scan Workspace from the Command Palette (
Ctrl+Shift+P, or Cmd+Shift+P on macOS), or click Scan workspace in the Deva sidebar.
- Findings appear in the Problems panel, inline in the editor, and in the Deva sidebar, grouped by file or by severity.
To try it on known-vulnerable code first, run Deva: Open Sample Vulnerabilities and scan the sample folder.
After the first scan, Deva keeps findings current:
- Live checks. Unsaved edits in open files are checked as you type with a quick subset of rules. These results are labelled
Deva LIVE and kept apart from full-scan findings.
- Watch mode. Saved files are re-checked when they change on disk, including changes made outside the editor by git, terminals and coding agents. Watch mode is on by default (
deva.watch.enabled).
Free and Pro
|
Free |
Pro |
| Price |
$0, no account needed |
$9.99 per user per month. Eligible accounts can start a 14-day trial without a card. |
| Workspace, file and live scans |
Yes |
Yes |
| Dependency analysis with OSV advisories |
Yes |
Yes |
| Rule catalog |
Yes |
Yes |
| Suppressions |
Yes |
Yes |
| JSON scan output |
Yes |
Yes |
| Deep and coverage scan profiles |
No |
Yes |
| Reachability analysis |
No |
Yes |
| AI finding validation and fix suggestions, with local models through Ollama (including Deva Coder) or your own Anthropic, OpenAI, Gemini or OpenRouter key |
No |
Yes |
| Compliance mapping and evaluation: NIST 800-53, PCI DSS, SOC 2 and OWASP Top 10, with FedRAMP, ISO 27001 and HIPAA in preview |
No |
Yes |
| SARIF, JUnit, Markdown, agent JSON, OSCAL Assessment Results and POA&M exports |
No |
Yes |
| Signed evidence and evidence history |
No |
Yes |
| SBOM export (CycloneDX, SPDX) |
No |
Yes |
Free scans keep working offline once the extension is installed. If a trial or subscription ends, Free scanning keeps working.
Suggested fixes open as a diff for you to review. Nothing changes in your files until you choose Apply reviewed fix, and the edited files are left unsaved.
Compliance mapping shows how code-level findings relate to framework controls and produces evidence for your own assessment. It does not certify compliance.
With a local model, inference runs on your machine. With your own key, the provider bills you for usage.
Start a Pro trial or subscribe
Run these from the Command Palette, or use the account area at the top of the Deva sidebar:
- Deva: Sign In with Google, GitHub or email.
- Deva: Start Trial starts your account's one-time 14-day Pro trial. No card is required.
- Deva: Subscribe to Pro opens checkout in your browser. When you finish, run Deva: Refresh Account Access.
- Deva: Manage Subscription opens the billing portal, where you can change or cancel your subscription.
Deva: Show Product Access lists what your account includes. Pro belongs to your Deva account, so the same plan applies when you sign in to the Deva CLI.
Privacy
- Scans run on your machine. The extension starts a local Deva process and sends it your code over a local connection. Scanning does not upload your code.
- With a local model (Deva Coder or another Ollama model), validation and fix suggestions also run on your machine, and your code does not leave it.
- With your own cloud key (Anthropic, OpenAI, Gemini or OpenRouter), the prompt and the relevant code context go directly from your machine to that provider. Your key is kept in your editor's secret storage, never in workspace settings.
- Dependency analysis looks up package names and versions on OSV.dev and the package registries (npm, PyPI, crates.io, RubyGems, Packagist). It does not send your source code.
- The extension also uses the network to sign in, refresh account access and open checkout or the billing portal, and to download local models you choose to install.
- macOS on Apple silicon (arm64)
- Linux x64 with glibc 2.28 or later
- Windows x64
Intel Macs, Linux on ARM and Alpine (musl) Linux are not supported. In remote workspaces (SSH, WSL or containers), Deva runs on the remote host, so that host needs to be one of the platforms above.
Deva works in VS Code 1.101 or later. Cursor, Windsurf and other VS Code-compatible editors built on VS Code 1.101 or later can install it from Open VSX.
Links
Developing this extension? See docs/DEVELOPMENT.md in the source repository.
License
Proprietary. Use is governed by the Deva Security End User License Agreement, included in the extension as LICENSE.txt. Copyright (c) DevSecCode, Inc. All rights reserved.
| |
