Not released yet. Vulnetix for VS Code is being built in the open. These pages document the design so it can be reviewed early; the extension is not on the marketplaces and the install steps do not work yet. Follow along on GitHub.

VSCodium

The telemetry-free community build. Open VSX by default; everything works.

Planned Designed and scheduled, not yet built. Documented so the design can be reviewed early.

VSCodium is VS Code built from source without Microsoft’s branding, telemetry or marketplace terms. The extension host is identical, so everything works.

Install

VSCodium ships pointed at Open VSX. Search Vulnetix in the Extensions view, or:

codium --install-extension vulnetix.vulnetix

Telemetry

VSCodium users tend to care about this, so plainly:

  • Scanning runs locally. Your source code is never uploaded.
  • The extension honours telemetry.telemetryLevel. Set it to off and nothing is sent, including from the CLI: the extension sets VULNETIX_NO_ANALYTICS=1 and DO_NOT_TRACK=1 in the engine’s environment and passes --no-analytics.
  • vulnetix.telemetry.enabled can only turn telemetry further off. It can never re-enable it when the editor says no.
  • Dependency lookups against the vulnerability database still happen, because there is no local copy of it. Those carry package coordinates, not code. See privacy.

Building from source

If you build VSCodium yourself and the marketplace is unconfigured, install the .vsix directly:

codium --install-extension vulnetix-<version>.vsix

Releases are attached to GitHub releases as well as published to Open VSX.

Didn't find what you needed? Tell us what's missing · Ask a question · Edit this page