Scan your codebase for OWASP Top 10 vulnerabilities, get AI-powered fix prompts, and run compliance checks against SOC 2, HIPAA, and PCI DSS — all from your editor.
Features
- One-click workspace scan — full OWASP Top 10 + dependency CVE analysis
- Compliance scans — targeted SOC 2 / HIPAA / PCI DSS gap analysis
- Inline diagnostics — findings appear as warnings/errors in the Problems panel
- Sidebar findings tree — browse findings grouped by severity (CRITICAL → LOW)
- AI fix prompts — copy the fix prompt to paste into your AI assistant
- Rich HTML report — scores, domain breakdown, roadmap, business report
- Status bar score — always-visible security score badge
- Scan on save — optional automatic scanning on file save
Quick Start
- Install the extension
- Run
Custodia: Set API Keyfrom the command palette (Ctrl+Shift+P) - Enter your API key (get a free one at custodia.dev/dashboard)
- Run
Custodia: Scan Workspace
Commands
| Command | Description |
|---|---|
Custodia: Scan Workspace |
Full scan of all workspace files |
Custodia: Scan This File |
Scan a single file (also in right-click menu) |
Custodia: Compliance Scan |
Scan targeting SOC 2, HIPAA, or PCI DSS |
Custodia: Set API Key |
Configure your API key |
Custodia: Show Last Report |
Re-open the HTML report panel |
Custodia: Copy Fix Prompt |
Copy an AI fix prompt to clipboard |
Settings
| Setting | Default | Description |
|---|---|---|
custodia.apiKey |
— | Your API key (sfp_...) |
custodia.apiUrl |
https://custodia.dev |
API URL (override for local dev) |
custodia.scanOnSave |
false |
Auto-scan files on save |
How It Works
The extension collects your workspace files (skipping binaries, node_modules, styles, etc.) and sends them to the Custodia API. The API runs a 5-stage AI security pipeline:
- Triage — classifies files and detects your stack
- Domain analysis — 6 security domains (auth, data, secrets, injection, logging, AI)
- Compliance mapping — OWASP/CWE/NIST/SOC2 references
- Synthesis — weighted score, verdict, roadmap
- Business report — executive summary for stakeholders
Results stream back as inline diagnostics, sidebar findings, and a rich HTML report.
Privacy
- Your code is sent to the Custodia API over HTTPS for analysis
.envfiles are automatically stripped before any AI processing- Scan results are cached per-user (same code = free re-scan for 30 days)
- No code is stored permanently — see custodia.dev/privacy
