ShipSafe Auditor by HamzaDev
Your Project's Automatic Security, Deployment & Media Health Guard.
ShipSafe 0.1.2 is a local, zero-configuration VS Code extension. Open a trusted project and it automatically inventories files, runs the documented static security and deployment checks, and analyzes project media. Findings appear in its dashboard and the Problems panel.
This is a first release candidate with deliberately bounded rule coverage, not completion of every advanced analyzer in the original roadmap. A completed check with no findings means No issues detected by the completed checks. It does not establish that an application is secure or guaranteed deployable.
A dashboard screenshot is included at docs/screenshots/media.png in the source and VSIX. It shows the production dashboard rendered against an actual scanner-generated test workspace using VS Code theme variables. Counts are fixture results; the screenshot is from the local browser test harness, not the VS Code window.
Install and use
- Download or locate
hamzadev-shipsafe-auditor-0.1.2.vsix from this project.
- In VS Code, run Extensions: Install from VSIX… and select the file.
- Open a folder/workspace. Once you trust the workspace, ShipSafe scans automatically after startup. No API key, account, CLI, backend, setup file or internet connection is needed.
- Open the shield icon in the activity bar, or run ShipSafe: Open Dashboard. Inspect Scan Coverage before interpreting results.
- Use Rescan, Pause, Resume, Cancel and Export as needed. Source saves and filesystem create/change/delete events trigger debounced updates.
Optional CLI installation:
code --install-extension ./hamzadev-shipsafe-auditor-0.1.2.vsix
Before installing hamzadev.hamzadev-shipsafe-auditor, uninstall any earlier local copies (shipsafe-local.shipsafe or hamzadev.shipsafe) to avoid running the same scanner twice. VS Code treats each publisher/name combination as a separate extension.
Requires VS Code 1.95 or newer with a Node-based extension host. Local disk workspaces and file-backed remote extension hosts are supported by design; virtual and browser-only workspaces are unsupported. Only macOS has been executed locally; see test evidence.
Delivered features
- Automatic
onStartupFinished activation, idle with no folder, Workspace Trust gating and a trust-grant event listener. No startup popups.
- Multi-root and nested manifest discovery; language inventory and framework detection from dependency metadata, not folder names or incidental mentions.
- Background async traversal, six concurrent file analysis slots, three streaming hash slots, cancellation, debouncing and in-memory results caching. Source/config analysis is incremental; each update still refreshes the file inventory and project context.
- Small UTF-8 text files in any language receive universal credential checks, including extensions with no dedicated analyzer.
- Syntax-aware TypeScript/JavaScript and PHP checks. Laravel route-group inheritance for the specific inline-closure patterns listed below.
- Production dotenv debug/loopback checks; public client environment exposure; Next.js bundled
env secrets/build-check bypass; Vite complete-environment definition; public-directory and Git-index sensitive-file checks.
- Image/video/audio counts, sizes, format inventory, image dimensions when readable, large-asset warnings, exact equal-size SHA-256 duplicate groups and estimated duplicate storage. Unique-size assets need no duplicate hash.
- Optional conservative Possibly Unused hints based on literal basename references; disabled by default.
- Theme-aware sidebar and dashboard with overview, security, deployment, media, duplicates, reports and coverage. Search, severity/confidence/type/size/duplicate filtering, sorting, 60-item pagination, open file, copy relative path and reference search.
- Problems diagnostics for source/configuration findings (media findings live in the dashboard; SVG media hints may also appear in Problems). Stale findings are replaced and removed with workspace/file changes.
- Local JSON, Markdown, HTML and SARIF 2.1.0 exports. Findings contain explanations, confidence, evidence summaries, rule/version IDs, relative paths and guidance, never source excerpts or credential values.
- One intentionally narrow automatic remediation: production
APP_DEBUG=true/1 → false. A diff preview and explicit approval are mandatory; changed/dirty documents are rejected. The edit uses WorkspaceEdit, is saved and verified, and schedules a rescan. Other findings provide guidance rather than speculative rewrites.
Coverage matrix
Coverage is specific patterns, not blanket support or verified compatibility with every framework version. Tests use fixture syntax, not installed application runtimes.
| Project/language |
Dedicated coverage in 0.1.2 |
Important limits |
| All projects |
Literal credential assignments, PEM headers, sensitive public/tracked paths, production dotenv/loopback config, manifest/media inventory |
UTF-8, file/workload/exclusion limits; no secret validation, entropy engine or runtime tests |
| PHP |
Request expressions in concatenated raw SQL, shell calls, eval, unserialize; MD5/SHA-1; client original upload filenames |
PHP parser grammar; no variable-to-variable taint propagation, full upload validation or templates |
| Laravel |
Above PHP rules; sensitive inline route closures; chained middleware/prefix/group and legacy group attributes; explicit Gate/authorization calls; production APP_DEBUG |
Laravel-style Route facade fixture patterns. Controller routes, controller/global middleware, guards, Form Requests, policies, service providers, macros and cross-file flows are unresolved. Unknown middleware is not called a confirmed vulnerability |
| JS / TS / Node / Express |
Request expressions in eval, exec, raw query concatenation, redirects and fetch; insecure credentialed CORS; browser token storage; weak crypto; errorhandler registration |
AST syntax patterns, not symbol/type resolution or complete taint analysis; aliases beyond supported import forms may be missed |
| React / JSX |
dangerouslySetInnerHTML; request-derived innerHTML writes; public environment credentials |
Does not prove whether a sanitizer or trusted content source is sufficient; .vue, .svelte and Blade templates get universal checks only |
| Vite |
Public VITE_ secret-like variables; define of the complete process.env; production loopback config |
Computed/spread/generated configs and dynamic environment flows are unresolved |
| Next.js |
NEXT_PUBLIC_ secret-like values; secret-like keys in next.config.* env; ignoreBuildErrors=true; shared JSX/JS rules |
No proof of route-handler/server-action authorization, server/client module separation or proxy protection |
| Python |
subprocess.*(..., shell=True) |
Narrow comment-filtered pattern; not a Django/FastAPI semantic analyzer |
| C# / .NET |
Explicitly disabled token signature/lifetime options |
No ASP.NET policy/attribute analysis |
| Java |
NoOpPasswordEncoder.getInstance() |
No Spring Security graph analysis |
| Dart / Flutter |
Unconditional true certificate callback |
No storage, release-mode or mobile permission analysis |
| Go |
InsecureSkipVerify: true |
No complete networking/taint analysis |
| Ruby |
verify_mode = ...VERIFY_NONE |
No Rails authorization analysis |
| Rust |
danger_accept_invalid_certs(true) |
No complete ownership/data-flow security analysis |
| C / C++ |
strcpy(destination, argv[...]) |
Narrow copy pattern; not general memory-safety analysis |
| Kotlin |
Always-true HostnameVerifier lambda |
No Android application security analysis |
| Swift |
URLCredential(trust: ...) review hint |
Custom trust evaluation can be valid; requires manual review |
| HTML / CSS / SQL / Docker / Kubernetes / Terraform / YAML / other |
Universal text, media and inventory checks |
Dedicated infrastructure/SQL/template rules are planned, not represented as passed |
Rule definitions, IDs and guidance are in src/scanners/. Dashboard coverage distinguishes completed, not-applicable, not-scanned and unsupported. completed reports eligible files and findings, not a proof of safety. Parser errors and unreadable files make the report partial.
Inventory: JPG/JPEG, PNG, WebP, GIF, SVG, BMP, ICO, AVIF, TIFF; MP4, WebM, MOV, MKV, AVI, M4V; MP3, WAV, AAC, M4A, OGG, FLAC, Opus. Extension recognition establishes inventory type; it does not certify valid media encoding.
Image dimensions use a bounded byte parser (first 256 KiB). Corrupt, unsupported or prefix-truncated metadata is identified as unreadable. SVG markup is never injected into the dashboard; opening an SVG from ShipSafe opens its source. Video/audio duration, codecs and bitrate are explicitly unsupported; inventory and duplicate detection remain available. Similarity/perceptual hashing, conversion/compression and deletion are planned. Identical bytes do not mean a path is safe to remove: multiple references may require every copy.
Possibly unused hints match literal media basenames in scanned text. This deliberately overestimates references and can miss dynamic/API/CMS/database/generated references. It never labels files safe to delete. Reference evidence is bounded to 100 names per source and 20 source paths per asset.
Privacy and safety
Core scans make no network calls, execute no project code/commands, invoke no shell or external binaries, install nothing and collect no telemetry. Project content stays on the extension host. Remote-host scans stay on that host; normal VS Code UI communication still delivers reports to your editor.
All file access is restricted to the workspace, with symlink/containment checks and no-follow opens where available. Symlinks are skipped, including broken/cyclic links. Background scanning never edits/deletes files. The dashboard uses textContent for project-derived values, local-only resources, a nonce-protected script and restrictive CSP. HTML exports contain no executable scripts. No secrets or raw source lines are placed in reports, diagnostics or logs. The user-requested fix diff shows local file contents in VS Code so the exact change can be reviewed; treat exported files and source previews according to your project policies.
Dependency manifests/lockfiles are inventoried. No vulnerability advisory database is bundled, and no online audit command/API is implemented. Offline scans do not invent advisory findings. AI integrations and external metadata tools are not implemented or called.
Exclusions and limits
Generated directories are excluded: node_modules, vendor, dist, build, coverage, .next, .git, .hg, .svn, caches, Python virtual environments, target, .turbo, .nuxt, .svelte-kit, out and .vscode-test. Root/nested .gitignore, .shipsafeignore and optional shipsafe.exclude entries are honored. Ignored production config is consequently not scanned; configuration checks only cover included files. Hard exclusions cannot be negated.
Default workload: 25,000 files per workspace, 1 MiB per text file, 16 MiB aggregate manifest text, up to 200 findings per source file and 20,000 retained source findings per scan. Truncation/read/parser failures make the report partial. Binary/non-UTF-8 source files are skipped. File inventory counts include media, manifests and files that may not receive semantic analysis; inspect text/scanned/skipped counts and coverage separately. The skipped counter counts excluded paths/directories, not a recursive count of all files within excluded directories.
Git tracking uses a read-only local index parser for v2/v3 (SHA-1 layout). Worktree indirection, split/v4/SHA-256 indexes and historical secret scans are unsupported. Lack of Git evidence is not scanned, not passed. There is no .git traversal, Git process, hook execution or outside-workspace access.
Optional VS Code settings customize automatic/live scanning, exclusions, file limits, per-scanner toggles, large-media thresholds, debounce delay and possibly-unused checks. Defaults work immediately. User settings are not prerequisites. Cache is in-memory and discarded on extension shutdown; same-size edits are detected through mtime/ctime and watcher invalidation.
Development
Use Node.js 22 LTS (22.13+), or a currently supported newer LTS, and npm. No global tooling is required.
npm ci
npm run check
npm run lint
npm test
npm run build
npm run test:host
npm run benchmark
npm run package
Press F5 to launch the extension development host. Unit tests generate disposable fixtures outside the workspace. Host tests launch isolated profiles of installed VS Code on macOS, or download an official test version on other systems if VSCODE_EXECUTABLE_PATH is not set. They never change your normal VS Code profile. Linux CI uses Xvfb. Testing details and actual results.
npm run package creates hamzadev-shipsafe-auditor-0.1.2.vsix with bundled parsers and no runtime npm installation. The manifest publisher is hamzadev, the package name is hamzadev-shipsafe-auditor, and the Marketplace display name is ShipSafe Auditor by HamzaDev. Upload this VSIX under the hamzadev publisher. The original shipsafe name was rejected as already used, so this candidate uses a distinct publisher-specific name and display name. Public search absence does not reserve a name; final availability is determined by Marketplace validation. Repository URL and supported-platform runs still need confirmation before any stable Marketplace release. Nothing is published by these commands. See release notes, implementation status and release checklist.
Detection references
The production checks follow the documented Laravel debug deployment guidance, Vite client environment exposure, Vite define behavior, and Next.js bundled env configuration. OWASP Top 10 provides risk/remediation context; rule references are not claims of a complete OWASP assessment.
License
MIT. Third-party dependency notices are in THIRD_PARTY_NOTICES.md and the generated bundles.
