Getting started

Install SecureSense, let it set up its tools, and triage your first findings — about ten minutes.

1. Install Python

SecureSense's analysis runs on Python 3.11 or newer. Install it from python.org (on Windows you can also run winget install Python.Python.3.12). Everything else is installed for you in step 3.

2. Install the extension

  1. Download securesense.vsix.

  2. In VS Code open the Extensions view (Ctrl+Shift+X), click ··· at the top, and choose Install from VSIX…. Pick the downloaded file.

    Or in a terminal: code --install-extension securesense.vsix

Quicker: search for SecureSense in the Extensions view and click Install. It's on the VS Code Marketplace (and on Open VSX for Cursor, Windsurf and VSCodium), and updates automatically.

3. Follow the tour

The Get started with SecureSense tour opens: an eight-step checklist where each step ticks itself off when you've done it. Reopen it any time with SecureSense: Getting Started.

  1. Check your setup → Check Setup. SecureSense tries Python, its agent, Semgrep and CodeQL and tells you what's missing.
  2. Install Missing Tools. It shows what it will download (the agent's packages and Semgrep from PyPI; CodeQL from GitHub, about 650 MB, verified against GitHub's checksum). Untick anything you don't want, then confirm.
  3. Optionally choose an AI model — add a free Groq key to get written explanations (see Evidence & AI triage). Without one, the rules still produce every verdict.

4. Scan

Open a Python project and click the shield icon in the Activity Bar, then Scan Workspace. Findings appear in the side panel grouped by severity, and as squiggles in the code. SecureSense then checks each finding: verdicts appear one by one — Confirmed, Likely vulnerability, Inconclusive or Likely false positive — and the list re-orders by priority.

5. Review and decide

Click the dashboard icon on the panel (or the 💡 lightbulb on a squiggle). Pick a finding to see the AI's rationale and the five evidence checks, then record your decision: Approve, Reject as false positive or Needs investigation.

Next steps

Running from source (developers)

To work on SecureSense itself, clone the repository and run the extension in development mode:

git clone https://github.com/hsmehrvi/securesense.git
cd securesense
python -m venv .venv
.venv\Scripts\activate            # macOS/Linux: source .venv/bin/activate
pip install -r agent/requirements.txt semgrep
cd extension && npm install && cd ..

Open the securesense folder in VS Code and press F5: a second window (the Extension Development Host) opens on the sample app samples/vulnerable_flask. After any change, close that window and press F5 again. npm run package in extension/ builds the installable securesense.vsix.

Something unclear or wrong? Edit these docs on GitHub.