Your first scan
Run a scan, read the results, and understand where each finding came from.
Run it
Open a project and run Vulnetix: Scan Workspace from the Command Palette, or press Ctrl+Shift+V then S.
The first scan of a project takes longer than later ones. The engine compiles its rule set on startup and then keeps it in memory, so subsequent checks are fast. Progress appears in the status bar and the scan can be cancelled at any point.
What you get
Squiggles in the editor. Underlines on the line responsible, coloured by severity. Hovering explains the finding and links to the rule’s documentation.
Entries in the Problems panel. Grouped by source, so you can filter to one
kind of issue: type @source:vulnetix-secrets in the Problems filter box to see
only secret findings. The sources are vulnetix-sca, vulnetix-sast,
vulnetix-secrets, vulnetix-iac, vulnetix-containers, vulnetix-license
and vulnetix-malware.
The Vulnetix sidebar. The icon in the activity bar opens a set of views: your security posture at a glance, findings grouped how you choose, dependencies by manifest, and available fixes.
Reading a finding
Take a vulnerable dependency. The squiggle sits on the line in package.json
that declares it, not at the top of the file and not on some internal lockfile
entry you did not write. The message names the package, how many vulnerabilities
it has, and the version to move to:
lodash@4.17.20 — 7 vulnerabilities (2 critical, 3 high). Safe: 4.17.21
Expanding the finding shows one entry per CVE, and, for a dependency you did not add directly, the chain that pulled it in:
introduced via express@4.17.1 → qs@6.5.2
That chain is the difference between “upgrade this” and “you cannot upgrade this directly, here is what to do instead”.
Why a package rather than each CVE
By default one dependency produces one finding, however many advisories it has. A popular transitive package can carry forty, and forty squiggles on one line of a lockfile makes the Problems panel useless. Nobody triages transitive CVEs one underline at a time; they decide whether to move the version.
If you want one finding per advisory, set
vulnetix.sca.diagnosticGranularity to vulnerability.
Severity, and why it is not just CVSS
A critical CVSS score on something nobody has ever exploited matters less than a high score with a working exploit in the wild. Findings carry the exploit picture alongside the score: whether it is in CISA’s Known Exploited Vulnerabilities catalogue, its EPSS probability, and whether public exploit code exists and how mature it is.
You can filter on it. vulnetix.qualityGate.exploits set to weaponized
surfaces only what is genuinely being used against people.
What happens as you type
After the first scan, code-level checks re-run on the file you are editing, debounced so they follow your typing rather than fighting it. That path never touches the network.
Dependency checks re-run when you save a manifest, and only when its contents
actually changed. Editing package.json without adding a dependency produces no
network traffic at all.
Secret detection runs on save rather than on every keystroke. It is by far the most expensive part of the rule set, and running it continuously would make the editor feel slow for a check that cannot fire until you have finished typing the secret anyway.
Next
- Fix a vulnerable dependency
- Triage a finding you are not going to fix
- Sign in for threat intelligence and organisation policy