🛡️ DeployShield

Deployment safety assistant for VS Code — prevent accidental commits of API keys, secrets, debug code, and insecure configurations before they ever reach production.

✨ Features

🚀 Getting Started

Installation

1. Open VS Code
2. Press Ctrl+P (or Cmd+P on Mac)
3. Type ext install deployshield
4. Press Enter

Or search for DeployShield in the VS Code Marketplace.

First Scan

1. Open any workspace/project folder
2. Press Ctrl+Shift+P to open the Command Palette
3. Type DeployShield: Scan Workspace and press Enter
4. View results in the Problems panel, sidebar, or dashboard

📖 Usage

Command Palette Commands

Sidebar

Click the shield icon in the Activity Bar (left side of VS Code) to open the DeployShield sidebar. It shows:

• Safety Score (click to open dashboard)
• Critical / High / Medium / Low grouped findings
• Recent Scans history
• Quick-action buttons

Status Bar

The status bar shows your current safety status:

• DeployShield: SAFE ✅ — no issues
• DeployShield: 5 Issues ⚠️ — non-critical issues
• DeployShield: 3 Issues 🚨 — critical issues detected

Click it to open the dashboard.

⚙️ Configuration

Open VS Code settings (Ctrl+,) and search for deployshield:

{
  "deployshield.autoScan": true,
  "deployshield.blockCritical": true,
  "deployshield.enableGitHooks": false,
  "deployshield.showStatusBar": true,
  "deployshield.ignoreNodeModules": true,
  "deployshield.scanOnSave": true,
  "deployshield.customPatterns": []
}

Custom Patterns

Add your own regex patterns to detect proprietary secrets:

{
  "deployshield.customPatterns": [
    {
      "id": "MY001",
      "name": "Internal API Token",
      "pattern": "mycompany_api_[a-zA-Z0-9]{32}",
      "severity": "critical",
      "description": "Internal API token detected"
    }
  ]
}

🙈 Ignore Rules

Create .deployshield.json in your workspace root to configure ignores:

{
  "ignorePatterns": [
    "tests/**",
    "sandbox/**",
    "mock-data/**",
    "**/*.test.ts",
    "**/*.spec.js"
  ],
  "ignoreRuleIds": [],
  "customPatterns": []
}

You can also right-click any issue in the Problems panel and choose Ignore rule DS004 (for example) to add it to the ignore list via quick fix.

🔗 Git Hooks

Run DeployShield: Install Git Hooks to automatically scan before every commit and push.

If critical issues are found, the commit/push is blocked with a clear message.

To bypass (unsafe): git commit --no-verify

To remove hooks: DeployShield: Remove Git Hooks

📊 Safety Score

Scoring:

• Critical finding: -25 points
• High finding: -10 points
• Medium finding: -5 points
• Low finding: -1 point

🛡️ Detection Rules

🔒 Privacy

DeployShield is 100% offline:

• No data leaves your machine
• No accounts or sign-up required
• No telemetry or analytics
• No cloud processing
• Works without internet

🛠️ Development

git clone https://github.com/vetrisuriya/deployshield-vscode
cd deployshield-vscode
npm install
npm run compile
# Press F5 in VS Code to launch the Extension Development Host

Running Tests

npm test

See CONTRIBUTING.md for full contribution guidelines.

📄 License

MIT — see LICENSE

🙌 Contributing

Contributions are welcome! Please read CONTRIBUTING.md before submitting pull requests.

To request a new detection rule or report a false positive, open an issue on GitHub.