Firebase Studio

Google's cloud workspaces, formerly Project IDX. Full support via Open VSX.

Firebase Studio (previously Project IDX) is a browser-based workspace built on Code OSS, with the extension host running in the workspace VM. Scanning works fully.

Install

Uses Open VSX. Search Vulnetix in the Extensions view, or declare it in the workspace configuration so every environment gets it:

# .idx/dev.nix
{ pkgs, ... }: {
  channel = "stable-24.05";

  packages = [ pkgs.curl ];

  idx = {
    extensions = [ "vulnetix.vulnetix" ];

    workspace.onCreate = {
      install-vulnetix = "curl -fsSL https://cli.vulnetix.com/install.sh | sh";
    };
  };
}

onCreate runs once when the workspace is created, which is the right hook: the CLI then persists with the workspace rather than being fetched on every start.

Worth knowing

Nix-based environments are scanned too. Firebase Studio workspaces are configured with Nix, and Vulnetix parses flake.nix and flake.lock as dependency manifests, so your environment definition is covered alongside your application’s dependencies.

Generated code is checked. Firebase Studio leans heavily on AI-assisted generation. Findings appear on generated lines as they are written, which is the point at which fixing them is cheapest.

Resource limits. Smaller workspace tiers have limited memory. If the engine is competing with your application, cap it:

{ "vulnetix.lsp.memoryLimitMb": 1024 }