Alert Security

Alert Security is a VS Code extension that helps prevent developers from accidentally committing or pushing secrets to remote repositories.

It combines:

• rule-based secret detection for common credentials and private keys
• risky filename detection for files like .env, *.pem, and *.key
• optional AI-assisted review to summarize whether flagged content looks truly sensitive
• git hook installation for pre-commit and pre-push

How it works

1. Install the extension from VS Code.
2. Open any git repository in VS Code.
3. Alert Security automatically installs repo-local hooks into .git/hooks.
4. Before git commit:
   • staged files are inspected from the git index
5. Before git push:
   • the refs being pushed are inspected
6. If suspicious content is found, the operation is blocked and a report is printed.

AI review

AI review is optional and acts as a second-pass summary layer. The hooks do not store your API key.

• For manual scans launched from VS Code, set alertSecurity.openAIApiKey in your settings.
• For hook-based scans, you can use OPENAI_API_KEY, OPENAI, or a repo-local .env file containing either variable before running git commands.

Commands

• Alert Security: Install Git Hooks
• Alert Security: Scan Repository

Local development

1. Open this folder in VS Code.
2. Press F5 to launch the Extension Development Host.
3. In the new window, open a git repository you want to protect.
4. Hooks auto-install when the repo opens, or you can run Alert Security: Install Git Hooks manually.

Packaging

npm install
npm run verify
npm run package:vsix

See PUBLISHING.md in the project root for Marketplace release steps.

Settings

• alertSecurity.enableAiReview
• alertSecurity.autoInstallHooks
• alertSecurity.showNotifications
• alertSecurity.openAIApiKey
• alertSecurity.openAIModel
• alertSecurity.maxFileSizeKb
• alertSecurity.failOnScannerError
• alertSecurity.blockedFilePatterns

Notes

• pre-commit scans staged content, not just working tree files.
• pre-push scans the refs being pushed and reads file contents from git objects.
• Large generated folders like node_modules, dist, and .git are skipped.
• This project is scaffolded as a local extension workspace and can be packaged with vsce package.