Hackaiz — security scanning inside VS Code
Find what an attacker would find — before you ship. Hackaiz scans the code you have open for exposed secrets, injections, broken authentication and risky patterns, then explains every finding in plain language: what was found, why it matters, and exactly what to do next.
Two clicks: the Hackaiz shield in the Activity Bar → Scan this workspace.
Why developers use it
|
|
| 🛡️ Scan in place |
Whole workspace or just the current file — from the sidebar, the editor or a right-click in Explorer. |
| 🔍 Results where you work |
Underlines in your code, entries in the Problems panel, and a grouped sidebar: Danger → To fix → To watch. |
| 💬 Explained, not just flagged |
Hover an underline for the short version, or open Show details for the full write-up with masked evidence. |
| 🔒 You stay in control |
You see the file list, what is excluded and the credit cost before anything is sent. Hackaiz never edits, commits or merges your code. |
| 🌐 Your whole platform |
Websites, APIs and repositories connected on hackaiz.com appear in the same sidebar with their findings and analysis history. |
What it looks for
- Secrets — API keys, tokens and private keys committed in code (evidence is always masked).
- Injection — SQL, OS command and code execution built from request values.
- Authentication & tokens — tokens accepted without a real signature check, missing authorization.
- Risky patterns — unsafe deserialization, weak crypto, dangerous AI/MCP tool exposure, insecure configuration.
- Dependencies — known vulnerable packages from your lockfiles.
Get started in one minute
- Click the Hackaiz shield in the Activity Bar.
- Click Connect personal key. No key yet? Create a key on hackaiz.com (Settings → Integrations) with read and launch.
- Click Scan this workspace, review the file list and confirm.
- Findings appear in the sidebar, as underlines and in Problems. Click one to jump to the line.
A guided walkthrough is also available: Help → Get Started → Get started with Hackaiz.
Privacy and security
node_modules, build output, binaries, files over 500 KB, .env files and keys are never sent.- Code is analysed in memory and not stored; only findings are saved to your account.
- Your key lives only in VS Code SecretStorage — never in settings files, logs or telemetry.
- Requests go only to
https://hackaiz.com and never follow redirects.
- Website and API targets can only be analysed after you prove you own them.
Credits
Scans use credits from your Hackaiz account, based on the work done. You confirm before every scan and see the actual total afterwards. If your balance runs out, Top up and Upgrade plan buttons appear right in VS Code.
Commands
| Command |
What it does |
Hackaiz: Scan this workspace |
Scan every eligible file in the open folder |
Hackaiz: Scan current file |
Scan only the file in the editor |
Hackaiz: Connect personal key |
Link VS Code to your Hackaiz account |
Hackaiz: Choose platform |
Pick which hackaiz.com platform this workspace belongs to |
Hackaiz: Run analysis |
Start a new analysis of the selected platform |
Hackaiz: Open report and approvals |
Open the full report on hackaiz.com |
Settings
| Setting |
Default |
Meaning |
hackaiz.projectId |
— |
Platform for this workspace (set by Choose platform) |
hackaiz.autoRefreshMinutes |
15 |
Auto-refresh interval; 0 turns it off |
hackaiz.showInlineDiagnostics |
true |
Show findings as underlines and in Problems |
Also available in your AI assistant
Hackaiz is listed in the official MCP Registry as io.github.Hacktualiz/hackaiz. Add https://hackaiz.com/mcp to Claude, Cursor or VS Code Copilot to read findings and run analyses from chat.
Website · Integrations guide · Help
| |
