Mixeway Flow - Security Scanner

VS Code extension for Mixeway Flow — a security scanning platform that detects vulnerabilities in your code repositories (SAST, SCA, IaC, Secrets).

Features

• Automatic Repository Detection — reads .git remote URL and matches it with a repository registered in Flow
• Security Findings Sidebar — displays vulnerabilities grouped by severity (Critical / High / Medium / Low) in a dedicated activity bar panel
• File Navigation — click on a finding to navigate directly to the affected file and line
• Editor Diagnostics — findings appear as warnings/errors in the VS Code Problems panel and as inline squiggles
• Run Scans — trigger a security scan from VS Code (default branch or a specific branch)
• Suppress / Reactivate — manage finding lifecycle directly from the IDE (right-click context menu)
• Finding Details — view full vulnerability details including description and recommendations in a webview panel

Setup

1. Install

Install from .vsix or from the VS Code Marketplace (once published):

code --install-extension mixeway-flow-0.1.0.vsix

2. Configure

Open VS Code Settings (Cmd+, / Ctrl+,) and search for Mixeway Flow:

Or add to settings.json:

{
  "mixewayFlow.url": "https://flow.example.com",
  "mixewayFlow.apiKey": "your-api-key-here"
}

3. Open a Git Repository

Open a workspace that contains a git repository registered in Mixeway Flow. The extension will:

1. Read the git remote URL (origin)
2. Search for a matching Code Repository in Flow
3. Load and display security findings

Usage

Sidebar

The Mixeway Flow shield icon in the activity bar opens the Security Findings panel. Findings are grouped by severity with icons indicating the source:

• $(code) — SAST (Static Application Security Testing)
• $(package) — SCA (Software Composition Analysis)
• $(server) — IaC (Infrastructure as Code)
• $(key) — Secrets Detection

Commands (Command Palette)

Context Menu

Right-click on a finding in the sidebar to:

• Suppress — mark as false positive, accepted risk, not applicable, or won't fix
• Reactivate — revert a suppressed finding
• Show Details — open full vulnerability information

Development

# Install dependencies
npm install

# Watch mode (auto-rebuild on changes)
npm run watch

# Build for production
npm run build

# Package as .vsix
npm run package

Project Structure

src/
├── extension.ts                 # Entry point, commands, lifecycle
├── api/
│   └── flowClient.ts            # HTTP client for Flow REST API
├── models/
│   └── types.ts                 # TypeScript interfaces and enums
├── providers/
│   └── findingsTreeProvider.ts  # Tree view data provider
└── utils/
    └── git.ts                   # Git remote URL detection

Flow API Endpoints Used

License

MIT