Documentation
Settings, the CLI binary, and telemetry.
Vulnetix works without configuration. This section is for when the defaults are wrong for your project.
Settings live where any VS Code setting does: user settings for you, workspace settings for a project, folder settings in a multi-root workspace.
Some settings are machine-scoped, which means a workspace cannot set them. That is a security boundary, not an oversight: vulnetix.cli.path and vulnetix.sast.rules both cause code to be executed, and a cloned repository must not be able to choose that code through a committed .vscode/settings.json.