Requirements
What you need before installing, and what you do not.
The editor
VS Code 1.96 or later, or any fork built on that version or newer. See supported editors for the full list.
The scanning engine
The extension does not contain a scanner. It drives the Vulnetix CLI, a single Go binary.
You do not need to install it yourself. On first use the extension downloads the
right build for your machine, verifies it against the checksums published with
the release, and keeps it in the editor’s own storage directory. If you already
have vulnetix on your PATH, that one is used instead.
Supported platforms:
| Operating system | Architectures |
|---|---|
| Linux | x86-64, arm64, arm, x86 |
| macOS | Apple silicon, Intel |
| Windows | x86-64, arm64 |
Linux builds are statically linked, so the same binary runs on Alpine and on glibc distributions without adjustment.
On anything else, including FreeBSD and 32-bit Windows, the extension will tell
you plainly rather than failing halfway through a download. You can
build the CLI from source
and point the extension at it with vulnetix.cli.path.
An account
Not required. The CLI ships with community credentials, so scanning works from the moment you install with nothing to sign up for.
Signing in adds private threat intelligence, organisation policy, reachability analysis, and the ability to publish results to your organisation. It also replaces the shared community rate limit with your own quota.
Network access
Scanning is local, but matching a dependency to known vulnerabilities needs a vulnerability database, so the extension looks up package coordinates (name, version, ecosystem) against the Vulnetix VDB. Results are cached on disk.
Your source code is never uploaded. See privacy and data handling for exactly what leaves your machine and when.
If you work behind a proxy or an air-gapped mirror, see managing the CLI binary.
Workspace trust
The extension requires a trusted workspace. It runs a binary against your files and honours workspace-scoped rule configuration, which in an untrusted workspace would be a way for a cloned repository to execute code. VS Code will prompt you the first time you open a folder.