Two scanners, one list
Semgrep's rules and CodeQL's data-flow analysis in one pass, with cross-scanner agreement raising priority. On the sample app, 17 raw hits become 7 findings.
Multi-scanner vulnerability triage for Python
Security findings you can actually trust.
SecureSense runs Semgrep and CodeQL, merges what they find, checks each finding against your code, and tells you which ones are real — with the evidence to prove it. Right inside VS Code.
- Semgrep + CodeQL
- Runs on your machine
- Open source (MIT)
SemgrepCodeQL
11
@app.route("/user")12
def user():13
uid = request.args["id"]14
q = f"SELECT * FROM users WHERE id={uid}"15
return db.execute(q)16
17
RATE = "60 * 60"18
limit = eval(RATE) Scanning with Semgrep + CodeQL…Gathering evidence…2 findings triaged · 1 real
Confirmedpriority 9.4
SQL injection · CWE-89- request.args reaches the query
- no sanitizer on the path
- exposed at GET /user
False alarmdismissed by rules
eval() on a constant- input never comes from the user
Features
Less noise, and a reason for every call.
Everything SecureSense does to turn a wall of static-analysis alerts into a short, explained list.
Evidence, not guesses
Every verdict cites concrete checks: does request data reach the line, is it sanitized, which route exposes it, is there a login decorator.
AI with guardrails
Rules make the keep/dismiss call. The model only writes the rationale and may never dismiss a finding.
Priority you can act on
Verdict × severity × scanner agreement: the exploitable SQL injection is on top.
Decisions with names
Approve, reject as false positive, or request investigation — per finding or for a whole group one fix resolves. Agreement with the AI is tracked.
Built for teams, private by design
Sign in with GitHub, sync to a shared project, add teammates by username. Scans run on your machine; source code is never uploaded.
The pipeline
How a finding flows through SecureSense
- 1Scan
Semgrep and CodeQL run side by side on your Python project, locally.
- 2Correlate
Duplicates across both scanners merge into one finding; related ones are grouped.
- 3Gather evidence
Five AST-based checks: user input, sanitization, callers, web exposure, CVEs.
- 4Verdict
Rules decide real vs. false alarm; an LLM explains why — and can never dismiss.
- 5Decide
Approve, reject or investigate in VS Code; the team sees it on the web.
Get started
From install to a shared, triaged list in four steps.
About five minutes from download to your first explained verdict.
- Install
Download the extension; the Getting Started tour installs the scanners for you.
Learn how - Scan
Run SecureSense: Scan Workspace in VS Code — Semgrep and CodeQL run side by side.
Learn how - Review
Read the evidence behind each verdict and decide in the dashboard.
Learn how - Share
Sign in with GitHub, sync the project, and invite your team by username.
Learn how
Measured, not claimed
The numbers behind the verdicts
1.00
recall — no labelled real vulnerability dismissed0.79
precision on the 26-case benchmark80%
of labelled false alarms filtered out0
lines of source code uploadedFrom SecureSense's own labelled 26-case regression suite (hybrid mode) — how they're measured.
Ready to cut the noise?
Install the extension, scan the included sample app, and see every verdict with its evidence.