Gardera Security

Find vulnerabilities, leaked secrets, and risky dependencies in the comfort of your IDE.

Features

Dependency Scanning

Scan your lockfiles for known vulnerabilities. Runs automatically when you open a workspace and again whenever a lockfile changes, so a vulnerable package is flagged as soon as you install it. Gardera downloads the scanner itself. No extra setup needed.

Secrets Scanning

Detect hardcoded secrets and credentials in your source files. Runs when you open a workspace and again whenever a file is saved or changes on disk (a git pull, a branch switch, a copied .env), so leaked keys are caught immediately.

Code Scanning (SAST)

Find security issues such as SQL injection, cross-site scripting, command injection and unsafe deserialization in Python, JavaScript/TypeScript, Java, C#, Go, PHP and more, with rules written by Gardera. Runs when you open a workspace and again whenever a file changes. Issues appear in the editor and the Problems panel; the lightbulb offers Show details and Ignore on this line, and gardera.sastExcludePaths skips files or folders. Dependency, build and test folders are never scanned.

GardWatch — Dependency Health Scoring

Protect yourself from supply chain attacks. Get a health score for your dependencies when you open or modify a lockfile. Understand which packages are well-maintained and which ones are a risk.

Platform Findings

Connect to the Gardera platform and the Platform tab shows the findings for the repositories you have open, with no extra clicks: every Gardera repository in the workspace, including multi-root workspaces and repositories one folder below the one you opened. Switch the scope to other repositories or a team to browse findings across your organization.

AI Agent Integration

Protect your AI coding assistant from installing risky dependencies. See gardwatch.dev for setup instructions.

Getting Started

1. Install the extension from the VS Code Marketplace
2. Click the Gardera icon in the Activity Bar

Local Scans

Dependency and secrets scanning work out of the box. No account or API key required. Dependency scanning runs when you open a workspace and whenever a lockfile changes; secrets scanning runs when you open a workspace and whenever a file changes. Click "Scan Workspace" in the Scanners tab to scan everything on demand.

Platform

To access platform features (findings), add your API key:

1. Open the Command Palette (Cmd+Shift+P / Ctrl+Shift+P) and run Gardera: Set API Key
2. Enter your API key (generate one here)

GardWatch for AI Agents

GardWatch can run as an MCP server so your AI coding assistant checks dependencies before installing them. Set up via Claude Code OAuth or add the MCP server manually. See gardwatch.dev/docs/setup for instructions.