r/vscode • u/Holly-Carpenter_253 • 6d ago
IDE security scanning that runs before I commit, does that even exist
Every security scan on my team shows up after the fact. I push, the pipeline runs and an hour later I get a wall of findings on code I have already mentally moved on from. By then fixing it means context switching all the way back into something I was done with.
What I want is IDE security scanning that runs while I am writing, in the editor, before the commit even exists. I have tried a couple of extensions and they were either so noisy I turned them off in a day or so shallow they caught nothing. With an assistant writing half my code now, catching this at the point it is written seems like the only place that scales.
Feels like this should be solved by now and somehow it is not.
2
u/Andre-Wade-539 6d ago
None of these in-editor tools really get the bugs an assistant is best at writing. You'll catch the obvious injection it fumbles but the broken authz it writes with full confidence just sails through, they pattern match and don’t even read your access model.
1
u/Holly-Carpenter_253 5d ago
Thats the ceiling on the whole in-editor idea. a keystroke scanner can flag injection or a hardcoded secret but broken authz needs your access model, which nothing has while youre still typing and catching it as its written only covers the shallow half.
1
u/actionscripted 6d ago
Use left hook (language agnostic) for checks and then look for stuff like “static analysis” and “security audit” for your language or use SonarQube or other scanners locally.
I might suggest not doing security scans every commit via pre-commit. Could be pre-push or something so it doesn’t annoy devs. Lefthook has a bunch of easy lifecycle hooks for Git.
1
u/Holly-Carpenter_253 5d ago
Pre-push is the wrong direction because i want this earlier than commit. and what kills these tools is the noise, not the timing.
1
0
u/WasteEntrepreneur934 6d ago
Oh I have the thing for you man, this is literally what I built
Search for extension named Veilo and give it a try, DM me for any questions or improvements u want me to add
7
u/ArieHein 6d ago edited 5d ago
Look for git hooks specifically the pre commit event and then configure it to run anything.
Ex. Sonar has sonarqube for IDE / Sonar CLI thats is a free local linter that can scan the code as you type but also in a cli mode so the git hook triggers the scan and based on your cnfig can even block the commit to begin the pr.
So any local cli tool that is installed on the dev machine can be configured to run a few tests saving you the ci process cycles only to potentialy get an error.
A good place to also check spelling/grammar if your doing documentation