VS Code

The AlertaVuln extension for Visual Studio Code puts REDYELLOWGREEN findings on the lines they affect, with fixes you can apply from the editor.

What it shows

Dependency findings - CVEs in your manifests (package.json, *.csproj, requirements.txt, go.mod, Cargo.toml, composer.json, Gemfile), highlighted on the affected line with severity, reasoning, and the fixed version when one exists.
Code scan (SAST) findings - flagged lines from AlertaVuln’s static analysis, highlighted the same way, with the rule, message, and a link to guidance.

Each flagged line gets a full-line colour wash in its severity tier, a gutter dot, and an end-of-line note; hover for the full reasoning and the available actions. GREEN findings are hidden by default. A branded Dash view in the activity bar summarises the counts and lists every finding as a card; click a card to jump straight to the code.

Fix and Fix All

Dependency findings with a known fixed version get a Fix action that edits the manifest for you. Fix all dependencies does every fixable dependency across the workspace in one edit, one undo. When the fix is a lockfile regeneration rather than a manifest edit, the extension opens a terminal with the right command pre-filled - it never runs a package manager for you.

Fix with AI (bring your own assistant)

Code scan findings don’t carry an automated fix. Fix with AI builds a remediation prompt from the finding, its reasoning, the flagged code, and guidance, and hands it to YOUR AI assistant - AlertaVuln has no model of its own. If a chat assistant is installed and detected, the prompt opens there pre-filled; otherwise it’s copied to your clipboard. Nothing about the finding or the code leaves your machine through the extension.

Local scanning and fix verification

Install the av CLI and the extension uses it to scan and verify fixes on your own machine. Nothing is pushed to the dashboard from the editor - local scans and checks stay local until CI scans the default branch, so your in-progress work never shows up in the org’s findings.

Local code scan - run AlertaVuln: Scan with local CLI, click Rescan on the Code Scan section, or enable scan-on-save (alertavuln.localScanOnSave). This runs av sast scan over your working tree and lists the results under Local Scan.
Verify a dependency fix - after you apply a dependency fix, the extension runs av check against the new version and tells you whether it is clean or carries CVEs of its own (with a suggested safe version if so).
Verify an AI fix - after Fix with AI on a code finding, the extension re-runs the local scan the next time you save that file - or on demand via AlertaVuln: Verify fix locally - and checks whether the finding is gone.
“Fixed locally” - once a local check confirms the fix (the code finding’s fingerprint is gone, or the bumped dependency is clean), the finding turns green and reads Fixed locally, distinct from the cautious pending rescan of a fix that is applied but not yet verified. That is your signal it is safe to commit.
Rescan buttons on the Dependencies and Code Scan sections re-check on demand - Dependencies re-fetches from the server, Code Scan re-runs the local scan.

The CLI is optional: without it the extension still works fully against the server, and you get a one-time prompt to install it for local verification.

Setup (once published)

In VS Code, open the command palette (Ctrl+Shift+P, or Cmd+Shift+P on macOS) and run AlertaVuln: Sign in. Your browser opens to AlertaVuln; authenticate with your existing login (Entra, Google, or email) and the editor is signed in. There is no key to copy or paste.
Open a workspace whose git remote matches a project’s connected repository in AlertaVuln - the extension matches by that repository URL automatically. If it can’t (monorepos, multiple remotes), run AlertaVuln: Choose project for this workspace or set alertavuln.projectId.
Optional: install the CLI to run local, offline code scans with AlertaVuln: Scan with local CLI - your source never leaves the machine and it doesn’t count against any quota.

Signing in mints a user-level access token tied to your own account, so the extension sees exactly your projects and your access, nothing more. The token is read-only (the extension only reads findings), lasts 90 days, and is stored in VS Code’s secret storage, never in settings. You can view or revoke it any time in AlertaVuln under Settings > Access tokens (the Personal access tokens page); revoking it signs the editor out.

Set an API key (advanced / CI)

Prefer Sign in for a personal editor. If you need a shared, org-level credential instead - for example a headless or CI setup - point the extension at an organisation API key:

In AlertaVuln, mint a ReadOnly organisation API key (Settings > API keys - see Get an API key). The extension only reads findings.
In VS Code, run AlertaVuln: Set API key and paste it in. The key is stored in VS Code’s secret storage, never in settings.

Organisation API keys are org-level and act on behalf of the whole organisation; the Sign in flow is preferred for a personal editor because it carries only your own access.

Settings

Setting	Default	Description
`alertavuln.projectId`	(empty)	Project id override when repo auto-mapping is wrong (monorepos).
`alertavuln.visuals`	`highlight`	How findings are shown: `highlight`, `squiggles`, or `both`.
`alertavuln.showGreen`	`false`	Show GREEN (informational) findings.
`alertavuln.refreshMinutes`	`15`	Poll interval for server findings (minimum 5).
`alertavuln.aiAssistant`	`auto`	Fix with AI: which assistant to hand the prompt to - `auto`, `ask`, `clipboard`, or a named one (`copilot`, `claude`, `cursor`, `windsurf`, `continue`, `cody`, `cline`, `roo`).
`alertavuln.cliPath`	(empty)	Path to the `av` CLI. Blank searches PATH.
`alertavuln.localScanOnSave`	`false`	Run the local CLI code scan on save.
`alertavuln.autoRunFix`	`true`	On a dependency fix, run the package-manager command for you in a terminal (off = pre-fill only).