Troubleshooting & FAQ
Common problems and quick answers. For detail, open View → Output and pick SecureSense from the dropdown.
Problems
"command 'securesense.scanWorkspace' not found"
The extension didn't start in that window. Close the Extension Development Host window and press F5 again. If you chose Debug SecureSense (breakpoints) from the Run view, the debugger may be failing to attach on your machine — use the default F5 configuration instead. Still failing: View → Output → Extension Host and look for red lines mentioning securesense.
"semgrep was not found" / "codeql was not found"
Run SecureSense: Check Setup to see exactly what's missing, then SecureSense: Install Missing Tools to install it. Or install the scanner (Installation), or set securesense.semgrepPath / securesense.codeqlPath to its full path. Semgrep installed in the repository's .venv is found automatically. SecureSense still works with just one scanner.
"Windows blocked it (Application Control / Smart App Control)"
Windows is refusing to launch the scanner (the underlying error is WinError 4551: An Application Control policy has blocked this file). On Windows 11 this is usually Smart App Control, which blocks programs it doesn't recognise; it can start blocking a tool that ran fine before. Options:
- Scan with the other scanner only — SecureSense works with either (CodeQL is signed by GitHub; Install Missing Tools can set it up).
- On a managed computer, ask your administrator to allow the file.
- Check Windows Security → App & browser control → Smart App Control. Be careful: once turned off, Smart App Control can't be turned back on without reinstalling Windows.
"Python not found" when triage starts
Create the repository's .venv (Installation) or set securesense.pythonPath.
Verdicts say rules-v1 though I set up a model
The model wasn't used, so the rules answered. The rationale ends with the reason, e.g. (LLM unavailable: HTTP 401…):
- 401 / 403 — the API key is wrong or revoked: run SecureSense: Set API Key again.
- 429 — free-tier rate limit; SecureSense retries, then falls back.
- Local model — start Ollama and run
ollama pull qwen2.5-coder:7b;autofalls back to rules when it isn't available.
"Cloud LLM (groq) is not configured: no API key"
Run SecureSense: Set API Key, or on the command line add GROQ_API_KEY=… to agent/.env.
Sync says the project "belongs to another team"
Someone else synced that repository first and owns the project. Ask them to add you (Manage Team, or the Team panel on the web).
Sync can't reach the server
Check securesense.server.url and that https://<server>/api/health returns {"ok":true,"database":"ok"}. An idle database can take a few seconds to wake — try again.
AI triage is slow
Use a cloud model (Groq usually takes a second or two per finding), a smaller local model like qwen2.5-coder:3b, or securesense.llm = rules.
FAQ
Which languages are supported?
Python gets the full pipeline. The scanners can report findings in other languages, but the AST evidence and verdicts are Python-only.
Do I need both scanners?
No. Either works alone; with both you get cross-scanner agreement, which raises confidence and priority.
Do I need an AI model?
No. The deterministic rules make every keep/dismiss decision anyway. A model adds a readable explanation and can raise undecided findings.
Can the AI hide a real vulnerability from me?
No. The model can't classify anything as a likely false positive; only the rules can, and only when they find concrete mitigation evidence. See Who decides.
Is my code uploaded?
Not unless you choose cloud mode, and then only the flagged function goes to your chosen provider. Team sync uploads findings and decisions, never files. See Privacy & data.
I changed a decision — which one counts?
The latest. The full history is kept and shown in both dashboards.
Why did a finding disappear from the squiggles?
You (or a teammate, after sync) rejected it as a false positive. It's still in the panel and dashboard.
Something unclear or wrong? Edit these docs on GitHub.