Positron

Posit's data science IDE. Open VSX; full support, and particularly useful for R and Python projects.

Positron is Posit’s data science IDE, built on Code OSS with a local extension host. Everything works.

Install

Positron uses Open VSX. Search Vulnetix in the Extensions view, or install a .vsix through Extensions: Install from VSIX.

Worth knowing for data science projects

Python and R dependency manifests are both understood. requirements.txt, pyproject.toml, Pipfile, poetry.lock, uv.lock and environment.yml on the Python side; DESCRIPTION and renv.lock on the R side.

Notebooks are a real gap worth naming. Scanning covers files on disk. Code inside .ipynb cells is not currently analysed for code-level findings, though the notebook’s declared dependencies are. If your risk is mostly in notebook cells, say so on the issue tracker: it changes how we prioritise it.

Unsafe deserialisation matters more here than in most stacks. pickle.loads, yaml.load without SafeLoader, and torch.load on an untrusted file are all remote code execution, and all are routine in data science code. These are exactly the kind of finding that is obvious on the line and invisible in review.

Model and dataset supply chain. Vulnetix inventories AI SDKs and model references into a CycloneDX AI Bill of Materials, so a project pulling weights from a hub is documented rather than assumed.