Browser-based editors

vscode.dev and github.dev. What works without a filesystem, and what cannot.

Planned Designed and scheduled, not yet built. Documented so the design can be reviewed early.

vscode.dev and github.dev run entirely inside the browser tab. There is no Node process, no ability to start a child process, and the files you see come from a virtual filesystem backed by an API rather than a disk.

Scanning means running a scanner over files. Neither of those exists here, so the extension runs in a reduced mode and is explicit about it rather than offering commands that would fail.

What works

Everything the Vulnetix service can answer directly:

  • Threat intelligence. Look up any CVE, GHSA or package: exploit maturity, KEV status, EPSS, indicators of compromise, ATT&CK mapping, detection rules.
  • Organisation policy. View, and where your role permits, edit your quality gate, package firewall and suppression rules.
  • Findings from a previous scan. Whatever your CI or a colleague’s editor last published for the repository. This is the state on the server, not the state of the file open in front of you.
  • Suppression management.
  • Sign-in. The device flow works normally in a browser.

What does not

  • Any scan, and therefore any finding about your current changes
  • Diagnostics in the editor
  • Code actions, quick fixes and autofix
  • SBOM, VEX, CBOM and AI BOM generation
  • Local malware scanning
  • Reading .vulnetix/memory.yaml

Why we do not fall back to scanning in the browser

We could ship a smaller scanner compiled to WebAssembly. We have chosen not to, because it would mean two engines with two sets of results, and “the browser said clean, CI said critical” is worse than an honest gap. One engine, running in one place, producing one answer.

What to do instead

Press . on a GitHub repository page to open github.dev, and then use Continue Working On… to move into a Codespace or a local clone. Both have a real filesystem and full scanning.

If your work is genuinely browser-only, Gitpod, code-server, Coder and Firebase Studio all present a browser interface while running the extension host on a machine with a filesystem. Those are fully supported.

Didn't find what you needed? Tell us what's missing · Ask a question · Edit this page