CodeSentry CWE Guard

CodeSentry CWE Guard is a local-first VS Code extension that alerts engineers while they work on code patterns related to the MITRE 2025 CWE Top 25 Most Dangerous Software Weaknesses and adjacent security issues.

The first implementation supports JavaScript, TypeScript, Python, Java, and Go. It scans on file save and through user-invoked commands, reports issues in the Problems panel, shows hover detail, offers suppression and simple fix actions, maintains a Findings sidebar, and exports findings as SARIF or JSON.

Current Detection Approach

This scaffold uses a built-in local scanner. It is intentionally dependency-free so it can run inside VS Code without sending source code anywhere.

• Conservative mode reports higher-confidence dangerous patterns.
• Strict mode adds broader heuristics for architecture and memory-safety CWEs that are harder to prove from one file.
• Suppression comments allow intentional exceptions.
• Export produces SARIF for code scanning systems or JSON for custom reporting.

See docs/detection-options.md for the recommended path from this MVP to Semgrep and CodeQL-backed scanning.

Additional Coverage

CodeSentry also reports common issues that usually come up in security review and UAT:

• Hard-coded credentials
• Weak cryptography and weak password hashing
• Insecure randomness
• Disabled TLS certificate validation
• Cleartext sensitive transport
• Permissive CORS
• Sensitive cookies missing HttpOnly or Secure
• Open redirects
• XXE
• LDAP injection
• NoSQL injection
• ReDoS-prone regular expressions
• Prototype pollution
• JWT/signature verification bypass
• Debug mode enabled

Commands

• CodeSentry: Scan Active File
• CodeSentry: Scan Workspace
• CodeSentry: Export Findings
• CodeSentry: Clear Findings

Suppression Comments

Place a suppression on the same line or the line immediately before the finding:

// codesentry-ignore CWE-79: content is already escaped by the template engine
element.innerHTML = trustedHtml;

Suppress all CWE checks on a line:

# codesentry-ignore: generated test fixture
pickle.loads(payload)

Suppress a block:

// codesentry-ignore-start CWE-125: fuzz test intentionally probes bounds
value := items[i]
// codesentry-ignore-end

Local Development

For a complete setup flow, see docs/SETUP.md.

Run the scanner tests:

npm test

Check JavaScript syntax:

npm run check

To try the extension in VS Code, open this folder and run the extension host from VS Code's extension development flow.

UAT

Use docs/UAT.md for the acceptance test flow. It includes automated checks, VS Code Extension Development Host steps, sample vulnerable files, scan-on-save validation, manual scan validation, hover and quick-fix checks, suppression checks, strict/conservative mode checks, and SARIF/JSON export checks.

Marketplace Readiness

The extension manifest includes VS Code contribution points, commands, settings, and sidebar registration. Before publishing, add final branding, icon assets, marketplace publisher details, repository metadata, and end-to-end extension-host tests.

Contributing

See CONTRIBUTING.md for branch workflow, local checks, rule contribution guidelines, suppression policy, and pull request expectations.