Settings reference

Every setting, its default, and what it does.

Planned Designed and scheduled, not yet built. Documented so the design can be reviewed early.

The engine binary

Setting	Default	Scope
`vulnetix.cli.path`	`""`	machine	Absolute path to a specific binary. Never auto-updated.
`vulnetix.cli.autoUpdate`	`prompt`	machine	`never`, `prompt` or `auto`
`vulnetix.cli.channel`	`stable`	machine	`stable` or `prerelease`
`vulnetix.cli.downloadBaseUrl`	GitHub releases	machine	For an internal mirror

Setting	Default	Scope
`vulnetix.scan.onStartup`	`false`	resource	Scan when a folder opens
`vulnetix.scan.onSave`	`file`	resource	`off`, `file` or `workspace`
`vulnetix.scan.onType`	`true`	resource	Code rules as you type. Never networked.
`vulnetix.scan.debounceMs`	`400`	resource	Quiet period after typing stops
`vulnetix.scan.features`	most on	resource	Per-scanner toggles
`vulnetix.scan.exclude`	`[]`	resource	Glob patterns to skip
`vulnetix.scan.depth`	`3`	resource	Directory recursion depth for manifests
`vulnetix.scan.respectGitignore`	`true`	resource

Setting	Default	Scope
`vulnetix.sast.rules`	`[]`	machine	External rule packs, `org/repo`
`vulnetix.sast.ruleRegistry`	`""`	machine	Where packs are cloned from
`vulnetix.sast.disableDefaultRules`	`false`	resource
`vulnetix.sast.suppressTestCode`	`false`	resource	Drop findings in test files
`vulnetix.sast.snippetContext`	`0`	resource	Snippet lines around a finding

Setting	Default	Scope
`vulnetix.secrets.onType`	`false`	resource	See performance before enabling
`vulnetix.secrets.gitHistory`	`false`	resource	Walk git history. Slow; better in CI.
`vulnetix.secrets.ignoreBinaries`	`true`	resource

Setting	Default	Scope
`vulnetix.sca.diagnosticGranularity`	`package`	resource	`package` or `vulnerability`
`vulnetix.sca.annotateLockfiles`	`transitiveOnly`	resource	`never`, `transitiveOnly`, `always`
`vulnetix.sca.autofixStrategy`	`stable`	resource	`stable`, `safest` or `closest`
`vulnetix.sca.maxMajorBump`	`0`	resource	Major versions a fix may cross

Setting	Default	Scope
`vulnetix.diagnostics.minimumSeverity`	`low`	resource
`vulnetix.diagnostics.mapLowTo`	`information`	window	`information` or `hint`
`vulnetix.diagnostics.showSuppressed`	`false`	resource
`vulnetix.decorations.gutterIcons`	`true`	window
`vulnetix.decorations.overviewRuler`	`true`	window
`vulnetix.codeLens.enabled`	`true`	resource
`vulnetix.inlayHints.enabled`	`false`	resource

Setting	Default	Scope
`vulnetix.qualityGate.severity`	`""`	resource	Fail at or above this severity
`vulnetix.qualityGate.exploits`	`""`	resource	`poc`, `active` or `weaponized`

An organisation policy overrides these. That is intentional: a policy a developer can opt out of is not a policy.

Setting	Default	Scope
`vulnetix.auth.preferEditorSession`	`true`	machine	Editor session outranks environment variables
`vulnetix.auth.allowCommunityFallback`	`true`	machine	Use built-in community credentials when signed out
`vulnetix.api.baseUrl`	`""`	machine
`vulnetix.api.webUrl`	`""`	machine

There is no setting for an API key. Settings files get committed. Credentials go in secret storage, via Vulnetix: Sign In.

Setting	Default	Scope
`vulnetix.lsp.enabled`	`true`	window
`vulnetix.lsp.trace.server`	`off`	window	`off`, `messages`, `verbose`
`vulnetix.lsp.maxCpu`	`0` (auto)	machine
`vulnetix.lsp.memoryLimitMb`	`2048`	machine
`vulnetix.lsp.idleShutdownMinutes`	`0` (never)	machine

Setting	Default	Scope
`vulnetix.telemetry.enabled`	`true`	machine	Can only turn telemetry further off

telemetry.telemetryLevel set to off disables everything regardless. See privacy.