SecureSense

Find the security vulnerabilities in your Python code that are actually real — with the evidence.

SecureSense runs Semgrep and CodeQL on your workspace, merges what they find, checks each finding against your code (does user input reach it? is it sanitized? is it on a public web route?), and labels it Confirmed, Likely vulnerability, Inconclusive or Likely false positive — with a priority score and an explanation.

Getting started

1. Install Python 3.11+ (python.org).
2. Install this extension. The Get started with SecureSense tour opens.
3. In the tour, click Check Setup, then Install Missing Tools — SecureSense installs its Python packages, Semgrep and (optionally) CodeQL for you, after asking.
4. Open a Python project and click Scan Workspace on the SecureSense panel (the shield in the Activity Bar).

Features

• Two scanners, one list — duplicates from Semgrep and CodeQL merge into one finding; agreement between them raises priority.
• Evidence for every verdict — five checks from your code's structure: user input, sanitisation, callers, web exposure (Flask, FastAPI, Django) and auth decorators, known CVEs in dependencies.
• AI with guardrails — deterministic rules decide what's real; an optional model (Groq, OpenRouter, or a local Ollama model) writes the explanation and can never dismiss a finding.
• Review dashboard — approve, reject as false positive, or request investigation; approve a whole group that one fix resolves.
• Team sync — sign in with GitHub, sync to a shared project, invite teammates, and see everything on the web dashboard.
• Private by default — scans run on your machine; source code is never uploaded.

Commands

Documentation

Full documentation: securesense-ngix.vercel.app/docs — installation, how scanning and AI triage work, every setting, privacy, and troubleshooting.

Requirements

• VS Code 1.90+
• Python 3.11+
• Semgrep and/or CodeQL (installed for you by Install Missing Tools)
• Python projects (Flask, Django, FastAPI or plain Python) get the full analysis