SecureSense documentation

SecureSense is a VS Code extension that finds security vulnerabilities in Python code with two static analysers, checks every finding against your code, and tells you which ones are real — with the evidence.

#What it does

Static analysis tools are noisy. A typical scan flags hundreds of lines, many of which are false alarms: the input was already sanitized, the code is never reached, or two tools reported the same bug twice. SecureSense sits between the scanners and you:

1. Scans your workspace with Semgrep and CodeQL, side by side, on your machine.
2. Correlates their output: duplicates from both tools become one finding, and findings that share one fix are grouped.
3. Gathers evidence for each finding from your code's structure (its AST): does user input reach it, is it sanitized, who calls it, is it on a public web route, do its dependencies have known CVEs.
4. Classifies each finding as Confirmed, Likely vulnerability, Inconclusive or Likely false positive, with a priority score and a rationale that cites the evidence.
5. Lets you decide — approve, reject, or ask for investigation — in an in-editor dashboard, and optionally shares everything with your team on the web.

#Where to go next

Something unclear or wrong? Edit these docs on GitHub.