#secrets

Herozion — Security scanner for VS Code and Cursor

herozion

Detect OWASP vulnerabilities, exposed secrets, and injection flaws inline while you code — no context switching required.

Token X-Ray

AndrewButson

X-ray vision for tokens and secrets: locally inspect JWTs, SAML assertions, certificates, OAuth tokens, and detect credentials in any file. No data leaves your machine.

SAST

InsomniaSAST

Inline secret + vulnerability scanning for your editor. Catches AWS/Stripe/JWT secrets, SQLi, command-injection and dependency CVEs as you save, and blocks git pushes that would leak them.

AI Code Exposure Monitor

ConsultantBPMhumansoftware

Live % of your code seen by AI assistants. Detects secrets, passwords, PII exposed to AI tools (Copilot, Claude, Cursor, etc.). 100% local. Works in VS Code, Cursor, Windsurf, VSCodium. MCP + team-work exposure features ready — just ask.

GHCP-MEM

ITcredibl

GitHub Copilot forgets everything between chats. GHCP-MEM gives it a local, auditable memory — seeded from your git history in 30 seconds — so every chat starts where the last one ended. No cloud backend, secrets redacted, every claim cited.

GitHub Guardian

DakshSrivastava

Real-time secret leak detection & SAST vulnerability scanner with inline diagnostics, Quick Fixes, and workspace scanning.

VibeSafe - Security Scanner

vibesafe-info

Scan your code for security vulnerabilities, exposed secrets, and bugs. Built for vibe coders. Official extension of vibesafe.info

Protect My Env

marcuspmd

Protects your .env files from accidental screen exposure.

SecretLoader

KiviAS

Pulls secrets from your vault and provides them to your app as environment variables when you run or debug, so they don't have to live in your config files. Works with Infisical, Doppler, HashiCorp Va

HTTP Forge AI

henry-huang

Turn GitHub Copilot, Claude, and Cursor into expert API engineers. HTTP Forge is the AI-native API platform for VS Code — full Postman compatibility, OpenAPI 3.0, headless CLI, cloud secrets, and TypeScript codegen, all local. This companion activates the built-in MCP server with 60+ tools. No extra

Catches security, secret, and auth risks in AI-generated code before you run, commit, or deploy. Watches changed files and warns in real time. Works in VS Code and Antigravity.

Shush

thedevlabs-io

Opens .env, .dev.vars, and JSON config files with their values redacted, so secrets never flash on screen during calls or screen shares.