PrivaSec - Security Linter for VS Code
PrivaSec is a zero-cost, 100% offline security linter extension for VS Code (optimized for Open VSX platforms like VSCodium and Gitpod). It runs purely client-side inside your IDE, requiring zero servers or backend infrastructure. License verification is done by pinging Gumroad directly from your machine.
Features
- 🔒 Real-time Secret Detection: Scans your code for leaked credentials before you save
- 🛡️ Multiple Pattern Support: Detects OpenAI keys, AWS credentials, GitHub tokens, Slack tokens, Google API keys, and private certificates
- ⚙️ Custom Patterns: Add your own regex patterns for organization-specific secrets
- 📊 Problems Panel Integration: Shows security issues in VS Code's Problems panel
- 🚫 Strict Mode: Optionally block saves when secrets are detected
- 🔑 Gumroad License Verification: Client-side license validation with timeout handling
Supported Secret Patterns
| Secret Type |
Pattern Example |
| OpenAI API Key |
sk-proj-... |
| AWS Access Key ID |
AKIA... |
| GitHub Personal Access Token |
ghp_... |
| Slack API Token |
xoxb-..., xoxa-..., etc. |
| Google API Key |
AIza... |
| Private Key Certificates |
-----BEGIN RSA PRIVATE KEY----- |
Installation
From Open VSX Registry
- Open VS Code or VSCodium
- Go to Extensions (Ctrl+Shift+X)
- Search for "PrivaSec"
- Click Install
Manual Installation
- Download the
.vsix file from the releases page
- In VS Code, go to Extensions
- Click the "..." menu and select "Install from VSIX..."
- Select the downloaded file
Usage
Setting Up Your License
- Purchase a subscription at Gumroad
- Copy your license key
- Open VS Code Settings (Ctrl+,)
- Search for "privasec"
- Enter your license key in the
Privasec: Gumroad License Key field
Configuration Options
| Setting |
Type |
Default |
Description |
privasec.gumroadLicenseKey |
string |
"" |
Your Gumroad subscription license key |
privasec.enableStrictMode |
boolean |
true |
Block saves when secrets are detected |
privasec.additionalPatterns |
array |
[] |
Custom regex patterns for secret detection |
Adding Custom Patterns
Add custom patterns in your settings.json:
{
"privasec.additionalPatterns": [
{
"pattern": "your_secret_pattern_regex",
"name": "My Custom Secret"
}
]
}
Commands
- PrivaSec: Retry Verification - Manually re-verify your license key
Requirements
- VS Code ^1.75.0 or compatible (VSCodium, Gitpod, etc.)
- Internet connection for initial license verification
- Node.js 18+ (for development)
Development
Setup
# Clone the repository
git clone https://github.com/privasec/privasec-extension.git
cd privasec-extension
# Install dependencies
npm install
# Compile TypeScript
npm run compile
# Watch for changes
npm run watch
Testing
# Run linting
npm run lint
# Package extension
npm run package
# Publish to Open VSX
npm run publish
Privacy & Security
- No Data Collection: PrivaSec does not send your code anywhere
- Client-Side Only: All scanning happens locally on your machine
- License Verification: Only your license key is sent to Gumroad's API
- No Telemetry: No usage statistics or analytics
Troubleshooting
License Verification Fails
- Check your internet connection
- Verify your license key is correct
- Ensure your subscription is active on Gumroad
- Try the "Retry Verification" command
False Positives
If PrivaSec flags legitimate code:
- Use non-strict mode (
"privasec.enableStrictMode": false)
- Add the file to
.gitignore if it contains test credentials
- Report false positives via GitHub Issues
License
MIT License - see LICENSE file for details.
Contributing
Contributions are welcome! Please open an issue or submit a pull request on GitHub.
Support
