The VS Code extension

The side panel, inline markers, AI triage, the review dashboard, and how decisions work.

#The Getting Started tour

On first start, VS Code opens Get started with SecureSense: eight steps, each with an explanation and a button — Check your setup, Choose an AI model, Sign in with GitHub, Run your first scan, Review findings, Share with your team, Explore the documentation. Steps tick themselves off as you do them (for example, Run your first scan completes when findings appear). Reopen it with SecureSense: Getting Started, from the panel's ... menu, or from Help → Welcome → Walkthroughs.

#The side panel

Click the shield icon in the Activity Bar. The Findings panel lists every finding:

• Grouped by severity — red critical, orange high, yellow medium, blue low.
• A ✔ check-mark icon means both scanners reported it; a ⚠ triangle means one scanner only.
• Once triaged, each finding shows its AI verdict and the list is ordered by priority score.
• Click a finding to jump to the line. Hover for the scanner message, the verdict and its rationale.

The panel's ... menu regroups by AI verdict, by file, or by correlation group (findings that one fix resolves together). The last scan is restored when VS Code restarts.

#Scanning

SecureSense: Scan Workspace (the ▶ button on the panel, or the Command Palette) runs Semgrep and CodeQL at the same time as background processes, so the editor stays responsive. If one scanner is missing or fails, the other's results are still used and the SecureSense output channel explains what went wrong.

#Inline markers

Findings appear as squiggles in the code. The message includes the category, the scanner message, and — after triage — the verdict and priority, e.g. AI: Confirmed (priority 13.5). Likely false positives are shown as a blue information marker; findings you rejected lose their marker.

#AI triage

After each scan the extension runs the triage agent in the background (turn this off with securesense.runAgentAfterScan). A notification shows progress (Triaging 3/7…) and can be cancelled. Each verdict appears as soon as it's ready.

Re-scans are fast: a finding whose code, context and model haven't changed reuses its saved verdict, so only changed code is re-checked. Run SecureSense: Run AI Triage to re-run it manually. How verdicts are made is explained in Evidence & AI triage.

#The review dashboard

Open it with the dashboard icon on the panel, the inline Review icon on a finding, or the 💡 lightbulb on a squiggle.

• Header: counts per verdict and the AI–analyst agreement percentage.
• Filters: All · Needs review · Confirmed · Likely · Inconclusive · Likely FP.
• List: findings by priority; ↑/↓ to move, Enter to open the line.
• Detail: the scanner message, the AI verdict with its rationale, and the five evidence checks.

#Making decisions

For each finding choose:

When several findings share one fix, Approve all N in this group (one fix) records the decision for the whole correlation group. Every decision is kept in a history (with your GitHub name if you're signed in), so you can change your mind — the latest decision counts.

AI–analyst agreement is the share of decided findings where you agreed with the AI: you approved something it called confirmed/likely, or rejected something it called a likely false positive.

#Signing in

SecureSense: Sign in with GitHub (person icon on the panel) uses VS Code's built-in GitHub sign-in. It's optional: it records who made each decision and is needed for team sync. SecureSense only reads your public profile.

#Commands

Something unclear or wrong? Edit these docs on GitHub.