A secret scanner and security toolkit inside VS Code

Four scans in one panel

Workspace audit

Hard-coded API keys, tokens and passwords (values are masked in the results), injection risks, weak cryptography and unsafe configuration.

Cloud & containers

Terraform, Kubernetes, Docker Compose, Dockerfiles and GitHub Actions.

Dependencies & config

Lockfiles, unbounded version ranges, abandoned or compromised packages, registry credentials and .env hygiene.

Endpoint scan

For a URL you are authorised to test: TLS, HSTS, security headers, CSP, CORS, cookies, auth behaviour and rate limiting. Active checks are off until you turn them on.

Everything runs locally except the endpoint scan, which only contacts the URL you enter.

Example: what a fix looks like

A key committed in source is readable by anyone with the repository, and stays in its history after you delete it:

const stripe = new Stripe("sk_live_…redacted…");

Read it from the environment instead, keep the real value out of Git, and rotate the key that was exposed:

const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);

Auth and header tools

• JWT Decoder & Signer: read claims, check expiry, verify or sign test tokens.
• OAuth 2.0 & PKCE Helper and Hash, HMAC & Webhook Signatures.
• CSP & Security Headers: build a Content-Security-Policy and the full header set for nginx, Express, Next.js, Vercel or Netlify, or audit the ones you send.
• Cookie Inspector and Certificate & SSL Pinning Inspector.

Good to know

• Each scan reads up to devsnip.securityAudit.maxFiles files (2,000 by default) and skips dependency, build and cache folders. Raise the setting for a large repository.
• It is a fast check while you work. Keep secret scanning in CI and a proper security review for anything that matters.

Tools in this area

Search all the developer tools →

Questions

Does the scanner upload my code?

No. The workspace, container and dependency scans run locally. Only the endpoint scan makes network requests, and only to the URL you enter.

Can I export the findings?

Yes, as Markdown or JSON, with each finding's evidence, severity and fix.