Vigilnz Security Scanner

Scan your workspace for security vulnerabilities directly from VS Code. Detect hardcoded secrets, code vulnerabilities, vulnerable dependencies, and infrastructure misconfigurations across JavaScript, TypeScript, Python, Java, and Go — all from your sidebar.

Thanks for installing

Thank you for using Vigilnz VS Code Extension — glad to have you!

We ship improvements regularly, so keeping the extension up to date gets you the best experience.

• On an older version? Update to the latest to get the newest checks, fixes, and improvements.

• Something acting up after an update? Try signing out and back in — and if it still misbehaves, a fresh reinstall usually sorts it out.

Manage everything anytime from VS Code Settings → Vigilnz.

---

Features

How Scanning Works

Scans run in two places, and which is used depends on the scan type:

Scan type	Where it runs	Your code leaves the machine?
SAST	Always local	No
Secret	Always local	No
IaC	Always local	No
SCA	Cloud or Local — your choice	Only in Cloud mode, and only manifests
SBOM	Cloud or Local — your choice	Only in Cloud mode, and only manifests

Source code is never uploaded for SAST, secret or IaC scanning — a bundled scanner analyses it on your machine.

For dependencies, vigilnz.dependencyScanMethod selects one method for both SCA and SBOM:

• Cloud (default) — your manifest and lockfile are analysed by the Vigilnz service, which carries the fullest advisory data.
• Local — advisories are resolved against an on-disk OSV database. Dependency scanning then works offline, and nothing at all leaves your machine.

Either way, results are published to your Vigilnz dashboard so a repository scanned locally appears there alongside the rest.

Note: vigilnz.scanMethod (the old CLI / API choice) is deprecated and kept only for migration. Use vigilnz.dependencyScanMethod.

What It Detects

SAST (Static Application Security Testing)

• SQL / NoSQL / Command / Code injection
• Cross-site scripting (XSS) and template injection (SSTI)
• Path traversal and open redirects
• Prototype pollution and header injection
• Broken authentication and access control
• Insecure deserialization, XXE, CSRF, SSRF
• ReDoS, mass assignment, sensitive data logging
• Insecure cookies, TLS, and cryptography

Secret Scanning

• Hardcoded API keys, tokens, and passwords
• Credentials detected via pattern matching and entropy analysis

SCA (Software Composition Analysis)

• Known vulnerabilities (CVEs) in project dependencies
• Direct vs transitive classification with full dependency paths
• Marks whether a vulnerable package is actually Reachable, Tests only, or Unused
• Flags CISA KEV (known exploited) and EPSS exploit probability so the dangerous findings sort first

SBOM (Software Bill of Materials)

• A full dependency inventory: package, version, licence, direct vs transitive, and the manifest it came from
• Licence policy checks — flag or block dependencies by licence
• Exportable as CycloneDX 1.5

IaC (Infrastructure as Code)

• Misconfigurations in infrastructure definition files (CLI scan method)
• Scans Dockerfiles, Docker Compose, Terraform, Kubernetes manifests, Helm charts, and CloudFormation templates

Supported Languages

SAST covers 36 languages across two analysis tiers.

Full syntax analysis — the file is parsed into a syntax tree, so findings understand code structure and data flow:

C, C++, C#, Go, Java, JavaScript, Kotlin, PHP, Python, Ruby, Rust, Swift, TypeScript

React files (.jsx, .tsx) and the Kotlin script and module variants (.kts, .mjs, .cjs) are covered by the same tier.

Pattern analysis — matched by security rules written for each language:

Bash, Clojure, CoffeeScript, Crystal, Dart, Elixir, Erlang, F#, Fortran, Groovy, Julia, Lisp, Lua, Nim, Objective-C, Perl, PowerShell, R, Scala, Solidity, SQL, V, Visual Basic

Secret scanning is language-independent and runs across the whole workspace.

Dependency scanning (SCA and SBOM) covers npm / yarn / pnpm / bun, pip, Go modules, Maven, Gradle, NuGet, Cargo and Bundler.

Monorepos

Local dependency scans discover manifests in nested folders, so every project in a monorepo is reported rather than only the one at the workspace root. Each finding names the manifest it came from.

Scan Summary Sidebar

A clean, focused panel that surfaces the summary first and keeps the controls out of the way:

• Findings Overview cards — Critical / High / Medium / Low counts at a glance. Click a card to filter the list to that severity; click again (or Clear filter) to reset.
• Findings by file — findings grouped by file, each tagged with its scan type (SAST, Secret, IaC, SCA) so you always know where a finding came from. Only this list scrolls; the summary and controls stay pinned.
• Search & filter — search files by name, and use the funnel to filter by scan type (All / SAST / Secret / IaC / SCA) or toggle Code Highlights. Active filters show as removable chips.
• Run Scan — pick which scan types to run from the button's dropdown; the active set is shown beneath it. Clicking Run with nothing selected opens the picker.
• Click any finding to jump directly to that line in the editor.
• In-editor diagnostic markers highlight vulnerable lines with severity-based colors.
• Summary footer shows total files affected and finding count, with a View Details link to the Vigilnz dashboard.

Dependency Fixes

Vulnerable dependencies are fixed in place — the extension edits the files rather than suggesting a command to run:

• Apply Fix — updates one package in the manifest and lockfile.
• Fix All — plans and applies every safe update in one pass.
• Each fix is verified: the lockfile is refreshed and the advisory re-checked. If the project no longer installs, the change is reverted automatically.
• Undo restores any applied fix, and Raise PR turns it into a pull request without leaving the editor.

Transitive dependencies — a vulnerable package you never declared yourself is pinned using each ecosystem's own mechanism: npm overrides / resolutions, a top-level pin for pip, require for Go, <dependencyManagement> for Maven, resolutionStrategy.force for Gradle, <PackageReference> for NuGet, [patch.crates-io] for Cargo, and a gem line for Bundler.

Safety controls:

• vigilnz.scaFixVerifyMode — fast (default) or strict verification.
• vigilnz.scaFixMajorUpgrades — what to do when the only advisory-free release is a new major version: ask, apply or skip.
• vigilnz.scaFixCleanTarget — check each planned version against the registry and advisories before anything is edited.

A fix that fails for a structural reason is not retried on every later scan. A failure caused by circumstance — offline, a registry timeout, a package that is not installed — is always retried.

AI fix suggestions remain available for findings that need judgement rather than a version bump, including SAST and IaC findings.

Risk Prioritisation

Not every vulnerable package is a real exposure. Findings carry:

• Reachability — Reachable (imported and called from your code), Tests only, or Unused. Toggle with vigilnz.reachability.enabled.
• Exploit intelligence — CISA KEV and FIRST EPSS probability, with a Sort: Risk option. Toggle with vigilnz.intel.enabled.
• Licence policy — flag or block by licence with vigilnz.license.denied, vigilnz.license.allowed and vigilnz.license.flagUnknown.

Full Results & Export

Beyond the sidebar, View Full Results opens a full-window view of every result in the workspace, with a History tab for past runs (kept up to vigilnz.history.maxEntries).

Results export as:

• Vigilnz JSON — the complete result set
• SARIF 2.1.0 — for GitHub code scanning and other SARIF tools
• CycloneDX 1.5 — an SBOM with licences and the dependency graph

Scan results are also published to your Vigilnz dashboard, so a repository scanned locally appears there alongside the rest.

Scoped Folder Scanning

Scan a specific sub-folder instead of the whole workspace — ideal for monorepos and multi-project repositories:

• Pick a target folder from the sidebar; SCA and secret scans are scoped to it.
• The active folder and scan status are shown in the sidebar's project card. When a sub-folder is selected, a ✕ next to it resets the scope back to the workspace root.
• Right-click any file or folder in the Explorer and choose "Scan with Vigilnz" to scan it directly.

Folder scanning is controlled by vigilnz.enableFolderScan.

Ignore Defects

Two ways to suppress findings:

• Line-level: Adds a // vigilnz-ignore comment above the flagged line. Both SAST and Secret scanners respect this comment. Ignored findings appear as strikethrough in the sidebar.
• File-level: Adds the file path to .vscode/settings.json (vigilnz.ignoredDefects). All findings in that file are suppressed.

Use the Quick Fix menu (hover over a finding, click the lightbulb) to:

• Ignore this defect (line) — inserts // vigilnz-ignore
• Ignore all defects in this file — adds to settings.json

Toggle ignored finding visibility with vigilnz.showIgnoredDefects.

Output Channel

View extension logs in the Output panel (Ctrl+Shift+U) by selecting "Vigilnz Security" from the dropdown. Logs include scan progress, errors, ignore actions, and API calls — useful for debugging issues in the published extension.

Auto Scan on Save

Scan-on-save is enabled by default (vigilnz.scanTrigger): saving a file automatically scans only that file using the fast CLI method, and results merge into existing workspace findings. Only the scan types you've enabled run — SCA is skipped (it's project-wide, not per-file), and IaC runs only for supported files (YAML, Terraform/HCL, JSON, Dockerfile). Disable the setting to turn this off.

Progress Notifications

Real-time progress updates during scans:

• CLI scans show file processing progress
• API scans show upload status and backend progress (files scanned, total files, current phase)

Help & Feedback

Quick access from the sidebar to:

• Extension overview on VS Code Marketplace
• Report an issue
• Extension settings

Requirements

• VS Code ^1.105.0
• A Vigilnz account (for OAuth sign-in) or a Vigilnz API key (for legacy sign-in)
• A workspace folder open (required to run a scan)

How to Use

1. Open the Vigilnz icon in the Activity Bar.
2. In the Account view, pick Sign in with OAuth (browser-based, recommended) or Sign in with API Key (legacy). For OAuth you can also run Vigilnz: Sign In from the Command Palette.
3. Click Run Scan to start a scan.
   • CLI: Runs locally — fast, no upload.
   • API: Uploads workspace to Vigilnz — no CLI required.
4. When the scan completes, findings are listed by file. Click a finding to jump to that line.
5. Use the refresh icon in the sidebar header to reload previous results, or the gear icon to open settings.
6. Use Upload Results to push CLI scan results to the Vigilnz dashboard.

Extension Settings

Setting	Type	Default	Description
vigilnz.scanTrigger	boolean	true	Automatically scan only the saved file on save (uses CLI; SCA skipped, IaC only for supported files).
vigilnz.scanMethod	string	"CLI"	Deprecated — use vigilnz.dependencyScanMethod. Kept for migration only.
vigilnz.environment	string	"Production"	Vigilnz environment: "Production" or "Development". Changing this requires signing in again.
vigilnz.enableFolderScan	boolean	true	Allow scoping scans to a selected workspace sub-folder. When off, scans always target the workspace root.
vigilnz.ignoredDefects	array	[]	File paths to ignore in scan results (committed via .vscode/settings.json).
vigilnz.showIgnoredDefects	boolean	true	Show ignored defects as strikethrough in the sidebar. Set to false to hide them entirely.
vigilnz.enableAnalytics	boolean	true	Send anonymous usage analytics to help improve Vigilnz. Set to false to opt out. See Privacy & Analytics.
vigilnz.respectGitignore	boolean	true	Skip files excluded by .gitignore.
vigilnz.maxScanConcurrency	number	—	Maximum files scanned in parallel.
vigilnz.showInlineHighlights	boolean	true	Highlight vulnerable lines in the editor.

Which scans run

Setting	Type	Default	Description
vigilnz.scanSast	boolean	true	Include SAST findings.
vigilnz.scanSecret	boolean	true	Include secret findings.
vigilnz.scanSca	boolean	true	Include dependency vulnerabilities.
vigilnz.scanSbom	boolean	true	Include the SBOM dependency inventory.
vigilnz.scanIac	boolean	true	Include IaC misconfigurations.

Dependency scanning

Setting	Type	Default	Description
vigilnz.dependencyScanMethod	string	"Cloud"	"Cloud" or "Local", for both SCA and SBOM. Local uses an on-disk OSV database and works offline.
vigilnz.sca.enableLocalAudit	boolean	false	In Cloud mode, also run a local SCA audit alongside the cloud scan. No effect in Local mode.
vigilnz.scaCloudPollIntervalSeconds	number	—	How often to poll for cloud SCA results.
vigilnz.scaCloudTimeoutSeconds	number	—	How long to wait for cloud SCA results before giving up.

Dependency fixes

Setting	Type	Default	Description
vigilnz.scaFixVerifyMode	string	"fast"	How Apply Fix / Fix All verify the project still installs: "fast" or "strict".
vigilnz.scaFixMajorUpgrades	string	"apply"	When the only advisory-free release is a new major version: "ask", "apply" or "skip".
vigilnz.scaFixCleanTarget	boolean	true	Check each planned version against the registry and advisories before editing.

Risk and licence policy

Setting	Type	Default	Description
vigilnz.reachability.enabled	boolean	true	Mark packages as Reachable, Tests only, or Unused.
vigilnz.intel.enabled	boolean	true	Add CISA KEV and EPSS exploit data, and the Sort: Risk option.
vigilnz.license.denied	array	[]	Licences to block.
vigilnz.license.allowed	array	[]	Licences to allow.
vigilnz.license.flagUnknown	boolean	false	Also flag packages that declare no licence.

Results panel

Setting	Type	Default	Description
vigilnz.history.maxEntries	number	20	Past scan runs kept in the History tab.

Commands

Available from the Command Palette (Ctrl+Shift+P / Cmd+Shift+P):

Command	Description
Vigilnz: View Scan Summary	Open the Vigilnz sidebar.
Vigilnz: Sign In	Start the OAuth 2.0 browser sign-in.
Vigilnz: Sign Out	Sign out and clear stored credentials.
Vigilnz: Refresh	Reload previous scan results for the current workspace.
Vigilnz: Check scan results	Poll for pending API scan results.
Vigilnz: Settings	Open Vigilnz extension settings.
Vigilnz: Scan with Vigilnz	Scan a file or folder selected from the Explorer context menu.
Vigilnz: View Full Results	Open the full-window results view, with export and scan history.
Vigilnz: AI Fix Suggestion	Generate an AI-assisted fix for an SCA dependency vulnerability.
Vigilnz: Add OpenAI Fallback Key	Store a personal OpenAI key used when the Vigilnz AI service is unavailable.
Vigilnz: Remove OpenAI Fallback Key	Delete the stored fallback key.
Vigilnz: Clear All Findings	Remove all current findings from the sidebar.
Vigilnz: Ignore This Defect (Line)	Add // vigilnz-ignore comment above the finding.
Vigilnz: Ignore All Defects in File	Add file path to the ignored list in settings.json.

Inline Suppression

Suppress specific findings by adding a comment above the flagged line:

// vigilnz-ignore
const token = "hardcoded-value";

# vigilnz-ignore
secret = "hardcoded-value"

Privacy & Analytics

To understand how the extension is used and to prioritize improvements, Vigilnz collects anonymous usage analytics, sent to the Vigilnz backend analytics service. This is enabled by default and can be turned off at any time.

Anonymous first, linked only after sign-in. Before you sign in, events are fully anonymous — identified only by a locally generated id and no authentication is attached. When you sign in, the extension links that anonymous activity to your account so your own usage stays consistent; events never carry your email or profile in the payload.

What is collected

• Session start (per activation) and first-ever activation
• Sidebar engagement: when the Vigilnz panels are opened (Scan Summary, Account, Help & Feedback) — so we can tell the extension is in active use
• Environment/context on every event: OS family + version, CPU architecture, editor name + version, extension version, and UI language — never file or workspace names
• Project size as a coarse bucket only (small/medium/large)
• Authentication outcomes: sign-in (method: oauth/apikey), sign-out, and sign-in failures (coarse reason only — network/timeout/invalid)
• Scan lifecycle events (workspace, folder, and on-save file scans): started, completed (counts by severity and type, duration, and a coarse duration bucket), and failed (a normalized error category plus a sanitized error message with any file paths and secret-like values redacted)
• Feature usage: cancel scan, clear findings, large-project blocks, CLI fallbacks, and toggling inline highlights

What is never collected

• Source code or scan finding contents
• File paths, file names, or workspace names (error messages are sanitized to strip paths and secret-like tokens before sending)
• Account email/profile in the event body, tokens, secrets, or any other personally identifiable information

Each install is identified only by a random, anonymous id generated locally on first run. Analytics is best-effort and never blocks the editor; if you are offline, events are queued locally and sent later. No data is collected when analytics is disabled.

License

MIT