AI Security Scanner

Catch prompt injection, data leakage, and AI API misuse in real time — right inside VS Code.

The Problem

AI-powered development is growing fast — and so are AI-specific vulnerabilities. Traditional SAST tools don't catch prompt injection, hardcoded LLM API keys, or eval() of AI-generated output. These risks slip into production silently.

AI Security Scanner is a zero-config, zero-telemetry VS Code extension that detects 45+ AI security anti-patterns the moment you type them — no cloud, no API calls, no data leaving your machine.

Key Features

💉 Prompt Injection Detection — 17 Patterns

Detects injection commands (ignore previous instructions, act as DAN), zero-width Unicode steganography, base64 obfuscation, unsanitized template interpolation in JavaScript and Python, and system prompts loaded from untrusted external sources.

🔓 Data Leakage Detection — 15 Patterns

Catches hardcoded API keys for OpenAI, Anthropic, Google, AWS, and HuggingFace. Detects private keys, generic secrets in variable assignments, database connection strings with credentials, PII patterns (emails, SSNs, phone numbers, credit cards), and data exfiltration risks.

⚙️ API Misuse Detection — 13 Patterns

Flags eval() / exec() / new Function() of AI responses (RCE risk), innerHTML from AI output (XSS), API keys in URL query parameters, client-side AI SDK instantiation, missing timeouts, SQL queries built from AI completions, retry without exponential backoff, unclosed streams, and missing rate limiting.

How It Works

Once installed, the extension activates automatically for JavaScript, TypeScript, Python, JSON, YAML, Markdown, and Plain Text files. No setup required.

① Real-Time Diagnostics

Security issues appear as red squiggly underlines (critical) and yellow underlines (warnings) directly in your editor — just like syntax errors. All findings also show in the Problems panel.

Scanning triggers on file open, on save, and as you type (500ms debounce).

② CodeLens Badges

Severity badges appear above every flagged line:

• 🔴 CRITICAL — Immediate security risk
• 🟡 WARNING — Potential vulnerability
• 🔵 INFO — Worth reviewing

Click any badge to open a detailed risk explanation with fix suggestions.

③ Hover Details

Hover over any flagged code to see a rich tooltip containing:

• What the risk is
• Why it's dangerous (with real-world examples)
• How to fix it (concrete code suggestions)

④ Security Report Dashboard

Open the interactive dashboard via the Command Palette:

AI Security Scanner: Show Security Report

The dashboard provides:

• Summary stats (critical / warning / info counts)
• Filter by severity or category
• Click any finding to jump to the exact file and line
• Export reports as JSON or Markdown

⑤ Status Bar Indicator

A persistent status bar item shows the current scan state:

• 🛡️ AI-SEC: ✅ Clean — No issues detected
• 🛡️ AI-SEC: 3 critical, 5 warnings — Click to open the report

Quick Start

1. Install the extension from the Marketplace
2. Open any project containing AI/LLM code
3. See issues highlighted instantly — no configuration needed

That's it. Zero setup, zero config, zero telemetry.

Commands

Open the Command Palette (Ctrl+Shift+P / Cmd+Shift+P) and type:

Configuration

All settings are optional. The extension works out of the box with sensible defaults.

Adding Custom Patterns

Define your own detection rules in settings.json:

{
  "aiSecurityScanner.customPatterns": [
    {
      "name": "Internal API Key",
      "pattern": "myapp-key-[a-z0-9]{32}",
      "category": "data-leakage",
      "severity": "critical",
      "message": "Internal API key detected in source code",
      "fix": "Move this key to environment variables or a secrets manager"
    }
  ]
}

Detection Pattern Reference

Supported Languages

Architecture

┌─────────────────────────────────────────────────┐
│                  VS Code Editor                  │
│                                                  │
│    On Type (500ms)  ·  On Save  ·  On Open       │
│              │            │           │          │
│              └────────────┼───────────┘          │
│                           ▼                      │
│               ┌───────────────────┐              │
│               │  Scanner Engine   │              │
│               │                   │              │
│               │  · Prompt Inj.    │              │
│               │  · Data Leakage   │              │
│               │  · API Misuse     │              │
│               │  · Custom Rules   │              │
│               └─────────┬─────────┘              │
│                         ▼                        │
│   ┌──────────────────────────────────────────┐   │
│   │             Findings[]                   │   │
│   └──┬──────┬───────┬───────┬──────┬────────┘   │
│      ▼      ▼       ▼       ▼      ▼            │
│   Problems CodeLens Hover  Status  Report        │
│    Panel   Badges   Tips    Bar   Dashboard      │
└─────────────────────────────────────────────────┘

All analysis runs locally using precompiled regex patterns. No network calls. No external APIs. No cloud processing.

Privacy & Security

This extension collects absolutely zero telemetry.

This is an architectural guarantee, not a policy — the extension literally has no code to make network requests.

Why AI Security Scanner?

Release Notes

1.0.0

• 🔍 45+ detection patterns across three threat engines
• 🔴 Real-time inline diagnostics with Problems panel integration
• 🏷️ CodeLens severity badges with click-to-detail
• 💬 Rich hover tooltips with risk explanations and fix suggestions
• 📊 Interactive security report dashboard with filtering and export
• 📊 Live status bar indicator
• ⚙️ Full configurability: severity thresholds, ignored paths, custom patterns
• 🔒 Zero telemetry, zero dependencies, fully local analysis

Feedback & Issues

Found a bug or have a feature request? Open an issue on GitHub.

AI Security Scanner
Because AI security starts in the IDE.