One-click AI-powered static application security testing for your codebase.

What it does

AI SAST Scanner analyzes your source code for security vulnerabilities using your existing AI coding assistant. It finds injection flaws, authentication issues, hardcoded secrets, misconfigurations, and more.

How to use

Open your project folder in VS Code (the root folder containing all your source code)
Right-click on the project folder in Explorer → click "Run SAST Scan"
Click "Continue" in the confirmation dialog
The scan prompt will be copied to your clipboard
Open your AI coding assistant (Claude Code, GitHub Copilot, Cursor, Amazon Q, or any AI tool)
Paste the prompt (Ctrl+V) and press Enter
Wait for the scan to complete
The report will open automatically with all findings

For large codebases

If your project has multiple services or modules (e.g., microservices), scan each service separately for better and deeper results. Open each service folder individually in VS Code and run the scan. Each scan generates its own report:

security-report-api-gateway.html
security-report-billing-service.html
security-report-user-service.html

Running a scan on the same folder again will overwrite the previous report for that folder. Rename the old report before rescanning if you want to keep it.