Veilo — Secret, Credential & PII Scanner

Catch secrets, credentials, and PII in your code before you commit — 100% local, nothing leaves your machine.

This extension bundles two license scopes: the detection engine (src/core/, src/detectors/) is MIT-licensed and open source — see veilo-engine. The extension shell, licensing, and commit-hook integration are proprietary. Full terms in LICENSE.md.

What it catches

Secrets & credentials — free, always on

Veilo ships with ~45 built-in credential detectors, each validated (format checks, entropy, context) to keep noise down:

• Cloud keys — AWS access & secret keys, GCP service-account keys, Google API keys, Azure client secrets, DigitalOcean, Heroku
• Provider tokens — GitHub (classic + fine-grained), GitLab, Slack, OpenAI, Anthropic, Stripe, SendGrid, Twilio, Mailchimp, Mapbox, Square, Shopify, npm, PyPI, Datadog, New Relic, Postman, Discord, Telegram
• Auth material — JWTs, bearer/OAuth/refresh tokens, hardcoded passwords, session & JWT secrets, OAuth client secrets, encryption keys
• Databases — connection strings (Mongo, Postgres, MySQL, Redis, …), DB passwords, DSNs
• Keys & webhooks — PEM private keys (RSA/EC/OpenSSH/PGP), Slack & Discord webhook URLs

Pro adds PII, security rules, auto-fix, and commit blocking

• PII detection (15 detectors) — email, IBAN, credit card, SSN, US ITIN/EIN, UAE ID, Saudi ID, IPv4/IPv6, MAC address, international & US phone numbers, passport numbers, dates of birth
• 25 security rules (VEILO-001…VEILO-025) — SQL/command/LDAP/XPath injection, unsafe eval(), pickle/YAML deserialization, weak hashing, hardcoded salts, insecure RNG, TLS verification disabled, hardcoded HTTP URLs, binding to 0.0.0.0, hardcoded JWT/session secrets, path traversal, insecure temp files, debug mode, secrets in logs, unpinned dependencies, XSS sinks, SSTI, permissive CORS, and more. Each finding links to its CWE.
• Quick-Fix auto-remediation — one-click fixes for a subset of security findings (e.g. yaml.load → yaml.safe_load, http:// → https://, mktemp → mkstemp, enable cert verification, bind to 127.0.0.1)
• Commit protection — a git pre-commit hook that redacts secrets in the committed snapshot (restoring your working tree afterward) and blocks commits containing severe security findings

How local is local?

All scanning runs on your machine. Veilo matches your code against local regex rules and validators — file contents, matched values, and findings are never sent anywhere. There is no scanning telemetry.

To be upfront about the one network call the extension makes: a Pro license key re-verifies with the license server once every 7 days at startup via POST https://veilo-ext.fly.dev/licenses/verify. That request sends only your license key so a revoked key can be deactivated — never any of your code. The license key itself is signed with Ed25519 and its signature is checked locally; the periodic call exists purely for revocation. If the server is unreachable, verification fails open and Veilo keeps working.

Controlling noise

Veilo is built to stay quiet on the false positives that make scanners get uninstalled:

• Inline ignore comments — suppress a line, the next line, or a whole file in any language:

  Directive	Also written as	Effect
  veilo-ignore	veilo-disable-line	Suppress findings on this line
  veilo-ignore-next-line	veilo-disable-next-line	Suppress findings on the next line
  veilo-ignore-file	veilo-disable-file	Suppress the entire file

• .gitignore + veilo.ignorePatterns — your .gitignore and built-in ignores (node_modules/, dist/, *.min.js, …) are always honored. Add gitignore-style globs to veilo.ignorePatterns to skip more, in both the editor and the pre-commit hook.

• Baseline allowlist — run Veilo: Accept Current Findings (Update Baseline) to write .veilo-baseline.json. Existing findings stop showing while new ones still surface. Commit it to share with your team; regenerate in CI with node out/cli/scan.js --update-baseline.

• Per-rule scoping — security rules only fire where they apply (e.g. Python eval vs JS eval are separate rules, and the unpinned-dependency rule only runs on manifest files) so you don't get double-reports or irrelevant hits.

• Confidence threshold — veilo.scoreThreshold (default 0.7) hides low-confidence matches.

Pricing

• Pro (individual): https://zeinsaleh.gumroad.com/l/cldizw
• Team: https://veilo-ext.fly.dev/team

Launch offer: use code EARLY20 for $20 Pro — first 30 customers only.

Quick start

1. Install from the VS Code Marketplace, or from a .vsix:

   code --install-extension veilo.vsix
   

   Veilo starts scanning on open and on save immediately — secret detection works out of the box, no setup.
2. (Optional) Install the commit hook — Pro users can run Veilo: Install Pre-Commit Hook from the Command Palette to redact secrets and block severe findings at commit time.
3. Activate Pro — open the Command Palette (Ctrl+Shift+P / Cmd+Shift+P), run Veilo: Enter License Key, and paste your key. The status bar shows Veilo Free or Veilo Pro; click it any time to manage your license.

Commands

Settings

Custom rules

Define your own detectors via veilo.customPatterns:

"veilo.customPatterns": [
  { "name": "ACME_INTERNAL_KEY", "pattern": "ACME-[A-Z0-9]{20}", "category": "secret", "severity": "HIGH" }
]

Each rule takes name, pattern (regex), and optional flags, score, category (secret/pii/security), severity, and description. Invalid regexes are skipped with a warning. Custom rules run in both the editor and the pre-commit hook (block-only — never auto-redacted).

CI / report mode

The headless scanner emits machine-readable output for pipelines and exits non-zero when severe findings exist:

node out/cli/scan.js --json          # JSON, staged files
node out/cli/scan.js --sarif --all   # SARIF 2.1.0, whole repo

Veilo: Scan Workspace from the editor writes a human-readable veilo-report.md grouped by file, with line numbers, severity, category, and remediation advice.

Compliance export (Pro)

Produce an auditable findings report — CSV or PDF — entirely on your machine. No file contents or findings data are transmitted anywhere; the whole path uses only local disk and crypto. The report lists the rule, severity, category, file and line for each finding — never the matched secret value itself.

From the editor: run Veilo: Export Compliance Report (CSV / PDF) from the Command Palette, pick a format, and choose where to save it.

From the command line / CI:

export VEILO_LICENSE_KEY="<your Pro key>"   # the headless CLI can't read VS Code SecretStorage
node out/cli/scan.js --report=csv --output=./veilo-report.csv
node out/cli/scan.js --report=pdf --output=./veilo-report.pdf

The Pro key is verified fully offline (Ed25519 signature). Without a valid key the export exits with a non-zero status and does nothing else.

Minting a test Pro key (maintainers)

For local testing you don't need the server or the admin /licenses/issue endpoint — keys are Ed25519-signed offline, so keygen.js mints a working key against the private key:

# keygen expects veilo-private.key alongside it (it lives at the repo root — copy it in first):
cp ../veilo-private.key .
node keygen.js test@example.com        # perpetual Pro key
node keygen.js test@example.com 7      # expires after 7 days
rm veilo-private.key                   # never commit or leave this lying around

Copy the printed Key value into VEILO_LICENSE_KEY (CLI) or Veilo: Enter License Key (editor) to exercise the full Pro flow.

How findings appear

• Red squiggle — secrets (free) and critical/high security issues (Pro)
• Yellow squiggle — PII and medium-severity security issues (Pro)
• Blue squiggle — low-severity issues (Pro)

Hover any squiggle for the description and remediation advice; security findings link to the relevant CWE. For security findings a Quick Fix lightbulb appears — press Ctrl+. / Cmd+. to apply a fix or view the full advice.

Privacy

No scanning telemetry. The extension reads only the files in your workspace and stores your license key in VS Code's built-in encrypted secret storage. The only network call is the 7-day license re-verification described in How local is local? — key only, never code.