Security findings where you are already looking.

Vulnetix finds vulnerable dependencies, insecure code, leaked secrets, container and infrastructure misconfiguration, and licence problems, and shows them where you are already looking: in the editor, on the line that causes them.

Scanning runs on your machine. The extension drives a language server built into the Vulnetix CLI, which holds the rule set in memory and re-checks only what changed as you type. Your source code does not leave your computer.

Get started · What it finds · Your editor

Where this is up to

The extension is being built in the open. Every page on this site carries a badge saying whether what it describes is shipped, in development, or planned. We would rather you knew than found out by following a tutorial that does not work yet.

Today: the extension installs, activates, and manages the Vulnetix CLI. The language server that produces in-editor findings is the work in progress.

Why an extension and not just CI

CI tells you about a vulnerability after you have written the code, opened a pull request, and moved on to something else. By then the fix is an interruption, the context is gone, and the finding competes with everything else in the queue.

The same finding in the editor, on the line, while you are still holding the problem in your head, is a thirty-second fix.

Vulnetix runs the same engine in both places. What CI blocks on is what your editor already showed you, which means no surprises at the pull request and no separate set of rules to reason about.

Not another linter

Most editor security extensions do one thing. Vulnetix covers the whole surface, because attackers do not respect the boundary between your code and your dependencies:

• Dependencies across npm, PyPI, Go, Maven, Cargo, RubyGems, NuGet, Composer, and about thirty more ecosystems, including transitive ones, with the safe version to move to.
• Your code, through a rule set covering injection, unsafe deserialisation, weak cryptography, authentication mistakes and more.
• Secrets, including ones committed earlier and still in git history.
• Containers and infrastructure, from Dockerfiles and Compose files to Terraform and Kubernetes manifests.
• Licences, so a copyleft dependency does not reach production unnoticed.
• Threat intelligence, so “critical” means something: known exploited, weaponised, or theoretical.

Works in your editor, whichever one that is

VS Code, Cursor, Windsurf, VSCodium, code-server, Gitpod, Coder, Theia, Kiro, Positron, Trae, and more. See the full list and how to install on each.