Settings reference
Open VS Code Settings (Ctrl+,) and search for SecureSense.
#Scanners
| Setting | Default | Description |
|---|
securesense.semgrepPath | semgrep | Path to the Semgrep executable. At the default, SecureSense also looks in the repository's .venv |
securesense.semgrepConfig | p/python | Rules passed to semgrep --config. A registry pack downloads rules (never code); point it at a local folder to scan offline |
securesense.codeqlPath | codeql | Path to the CodeQL executable |
securesense.codeqlSuite | python-security-and-quality.qls | CodeQL query suite |
#AI triage
| Setting | Default | Description |
|---|
securesense.runAgentAfterScan | true | Run triage automatically after each scan |
securesense.llm | auto | Which model explains the verdicts — see below |
securesense.cloud.provider | groq | groq, openrouter or custom (any OpenAI-compatible API) |
securesense.cloud.model | (provider default) | e.g. openai/gpt-oss-20b (Groq) or qwen/qwen3.8-27b:free (OpenRouter) |
securesense.cloud.baseUrl | (empty) | Base URL ending in /v1, for the custom provider only |
securesense.ollamaModel | qwen2.5-coder:7b | Local Ollama model |
securesense.offline | false | Skip OSV.dev vulnerability lookups (sends only package names and versions) |
#securesense.llm values
| Value | What happens |
|---|
auto | Local hybrid if Ollama is running with the model, otherwise rules |
cloud | Rules decide; a hosted model (Groq/OpenRouter/custom) writes the rationale. Sends the flagged code and evidence to that provider. Set a key with SecureSense: Set API Key |
hybrid | Rules decide; the local Ollama model writes the rationale (requires Ollama) |
rules | No model: instant, deterministic rationales |
ollama | Experimental: the local model decides alone. It scored worse than the rules on the benchmark — for comparison only |
API keys are not settings: they're stored encrypted in your OS keychain via SecureSense: Set API Key.
#Team sync
| Setting | Default | Description |
|---|
securesense.server.url | https://securesense-ngix.vercel.app | The SecureSense server for Sync and Manage Team. Clear it for developer mode (direct database sync from agent/.env) |
#Advanced
| Setting | Default | Description |
|---|
securesense.pythonPath | (empty) | Python interpreter for the agent. Empty: the repository's .venv, else python on PATH |
securesense.agentPath | (empty) | Folder containing the securesense_agent package. Empty: the agent folder next to the extension |
Something unclear or wrong? Edit these docs on GitHub.