Skip to main content

​
Overview

The ZeroPath Security extension integrates the ZeroPath platform directly into VS Code. View security scans, browse vulnerabilities, and apply AI-generated patches without leaving your development environment.

​
Installation

1

Open Extensions

In VS Code, press Ctrl+Shift+X (Windows/Linux) or Cmd+Shift+X (macOS).
2

Search & Install

Search for “ZeroPath Security” and click Install.
3

Get Started

Click the ZeroPath icon in the Activity Bar (left sidebar) to open the setup panel.

​
Prerequisites

  • VS Code version 1.74.0 or higher
  • Git installed and on your PATH
  • Your workspace should be a Git repository with a remote named origin
  • Viewing repository scans and issues requires the origin remote URL to match a repository that has been added to and scanned by ZeroPath
  • A ZeroPath account with API credentials (obtain from Settings → API Tokens)

​
Authentication

  1. Click the ZeroPath icon in the Activity Bar (left sidebar).
  2. Click “Configure Credentials” in the welcome screen.
  3. Enter your API Token ID and API Token Secret (from the ZeroPath dashboard under Settings → API Tokens).
  4. Select your VCS provider (GitHub, GitLab, Bitbucket, or Generic).
Credentials are stored securely in VS Code’s Secret Storage (OS-level encrypted storage — Keychain on macOS, Credential Manager on Windows, libsecret on Linux). They are never written to settings.json. The extension automatically detects your organization from your API token and matches your workspace to the corresponding ZeroPath repository using your Git remote URL. The extension adds a dedicated sidebar panel accessible via the ZeroPath icon in the Activity Bar.

​
Scans Section

  • View the 5 most recent scans for your repository
  • Filter by scan type: Full Scans, PR Scans, or Both
  • Each scan shows:
    • Status badge (completed, running, failed)
    • Open issue count
    • Scan type and timestamp
  • Click a scan to load its associated issues

​
Issues Section

  • Search issues by title, description, file, vulnerability class, or severity
  • Issues sorted by priority score, then severity, then confidence
  • Each issue shows:
    • Title, severity badge (color-coded), and status
    • Affected file and line number
    • Patch availability indicator
  • Expand any issue to see:
    • Full description and remediation guidance
    • Score, severity, confidence, CWEs
    • Affected code snippet
    • Patch diff (if available)
    • Link to the ZeroPath dashboard

​
Severity Colors

​
Commands

All commands are accessible via the Command Palette (Cmd/Ctrl+Shift+P):

​
On-Demand Code Scans

Use on-demand async code scans when you want ZeroPath to inspect the file or snippet you are working on without starting a full repository scan.
1

Open a saved file

Open a file inside your workspace. For snippet scans, select the code you want ZeroPath to inspect.
2

Run a scan command

Use Zeropath: Scan Active File with ZeroPath or Zeropath: Scan Selection with ZeroPath from the Command Palette or editor context menu.
3

Add context when useful

Use the with Context variants when ZeroPath should know something that is not obvious from the code, such as which inputs are attacker-controlled or how the route is reached.
4

Review results

Results are shown in the ZeroPath Async Code Scan output channel and include severity, file location, description, CWE, and suggested fix details when findings are found.
On-demand scans use your workspace Git remote as repository context when it matches a linked ZeroPath repository. If no linked repository matches, the scan still runs in standalone mode.

​
Applying Patches

The extension supports three patch workflows:
When a finding has an AI-generated patch, the expanded issue view shows an “Apply This Patch” button alongside a syntax-highlighted diff preview. Clicking it applies the patch locally via git apply.
For issues without an existing patch, click “Request Patch” in the sidebar. ZeroPath will generate a fix server-side, and the sidebar will update when the patch is ready.

​
Configuration

Configure the extension through VS Code Settings (Cmd/Ctrl+,):

​
Troubleshooting

Ensure you have a folder open in VS Code with an initialized .git directory.
Verify your repository has a remote origin: run git remote -v.
Check your API credentials are correct and your token has access to at least one organization. Set zeropath.organizationId manually in settings if auto-detection fails.
Ensure you have no uncommitted changes that conflict with the patch. Try pulling the latest changes first.