Troubleshooting

Start here

Vulnetix: Show Output from the Command Palette. The log records the extension version, the resolved CLI path and version, where that binary came from, and every scan with its outcome. Nearly every question below is answered by the first twenty lines of it.

For a protocol-level trace, set vulnetix.lsp.trace.server to verbose and reproduce the problem. That is what to attach to an issue.

Nothing happens at all

Is the extension active? Extensions view, find Vulnetix, check it is enabled for this workspace.

Is the workspace trusted? The extension requires trust, because it runs a binary against your files. An untrusted workspace shows a banner at the top of the window.

Is the editor recent enough? VS Code 1.96 or later, or a fork on that base. Help → About.

Is there a folder open? With no folder there is nothing to scan.

It cannot find or download the CLI

The output channel names the reason. Common ones:

No network route to GitHub. Point at an internal mirror serving the same layout, including checksums.txt, or install the binary yourself and set vulnetix.cli.path:

{ "vulnetix.cli.downloadBaseUrl": "https://artifacts.internal/vulnetix" }

Checksum mismatch. The download did not match the published hash and was discarded. Usually a proxy rewriting responses. There is no override, deliberately: use a vetted binary via vulnetix.cli.path.

Unsupported platform. Binaries exist for Linux, macOS and Windows on the architectures listed in requirements. Elsewhere, build from source and set vulnetix.cli.path.

Cannot execute after download. On Linux, check the storage directory is not mounted noexec. On macOS, see below.

macOS says the binary cannot be opened

Gatekeeper quarantine. The managed download does not trigger it, but a binary you downloaded in a browser will be quarantined.

xattr -d com.apple.quarantine /path/to/vulnetix

The simplest fix is to remove vulnetix.cli.path and let the extension manage the binary.

It says my CLI is incompatible

The extension and the server share a protocol version that must match exactly. “Too old” offers a download of the version it expects; “too new” means update the extension.

If you have pinned vulnetix.cli.path, the extension will not silently fall back to a different binary: you asked for that one, so it tells you rather than quietly using another.

Findings are not appearing

On the wrong trigger? Code findings update as you type; secrets only on save; dependencies only when a manifest’s contents change. See features.

Filtered out? Check vulnetix.diagnostics.minimumSeverity and vulnetix.qualityGate.exploits. A severity filter is the usual answer.

Suppressed? Set vulnetix.diagnostics.showSuppressed to true to see suppressed findings, and where each suppression came from.

Excluded? Check vulnetix.scan.exclude and your .gitignore; the scanner honours gitignore by default for code files.

Too large? Files over about 1 MB are not content-scanned. The scan reports this as a degradation rather than reporting the file as clean.

Dependency findings specifically

No lockfile. Some ecosystems need one. Composer, for instance, requires composer.lock or an installed vendor/ directory; the error names what is missing.

Rate limited. The community tier shares a quota. The status bar shows remaining quota; sign in for your own.

Offline. Local scanning continues; dependency findings fall back to cache and the extension says so.

The editor feels slow

{
  "vulnetix.scan.onType": false,
  "vulnetix.scan.debounceMs": 1000,
  "vulnetix.scan.exclude": ["**/generated/**", "**/vendor/**", "**/dist/**"],
  "vulnetix.lsp.maxCpu": 4
}

If vulnetix.secrets.onType is on, turn it off first: it is roughly 20 times the cost of everything else combined. See performance.

Sign-in does not complete

Browser did not open. The notification contains the URL; open it manually.

Code expired. They last five minutes. Start again.

“This account is linked to multiple organisations.” Your email matches more than one organisation and the server cannot choose. Contact support to resolve it.

Behind a proxy. The device flow needs to reach www.vulnetix.com. Set HTTPS_PROXY in the environment your editor inherits, which on macOS and Linux means launching it from a shell that has it.

Reporting a problem

Include the output channel contents with vulnetix.lsp.trace.server set to verbose, your editor and version, your operating system, and vulnetix version from a terminal.

Open an issue. Redact anything sensitive: the log can contain file paths.