Beyond pull requests
VS Code extension
Review files and changes in your editor before you open a pull request.
The VS Code extension reviews the file you’re working on and shows findings where you’d see compiler errors: underlined in the editor and listed in the Problems panel. Fix things before they reach a pull request.
Install#
Note
The extension isn’t on the VS Code Marketplace yet. Build and install it from source; it needs VS Code 1.85 or later.
Terminal
git clone https://github.com/noumanas/audit-bench-vscode-extenstion.git cd audit-bench-vscode-extenstion npm install npm run compile npm run package code --install-extension auditbench-vscode-0.1.0.vsix
Sign in#
- In the app, open Repository scan and copy your CLI / CI-CD API key (it starts with
abk_). - In VS Code, open the Command Palette (⌘ Shift P on Mac, Ctrl Shift P elsewhere) and run Audit Bench Ai: Set API Key.
- Paste the key. It’s kept in VS Code’s secure storage, not in your settings.
Commands#
| Command | What it does |
|---|---|
| Audit Current File | Review the open file. Also in the editor’s right-click menu and title bar |
| Fix All Issues with AI | Apply fixes for the file’s findings, then recheck. Needs a plan with repository scanning; up to three AI calls |
| Clear Findings | Remove the current findings from the editor |
| Account & Usage | Your plan and remaining usage |
| Show Logs | The extension’s log, for troubleshooting |
| Set API Key | Sign in or switch accounts |
Findings appear as diagnostics; hover one for the full explanation and suggested fix. The status bar shows the verdict, what the review cost, and your plan’s remaining usage.
Settings#
| Setting | Default | Meaning |
|---|---|---|
auditbench.auditOnSave | Off | Review a file every time you save it |
auditbench.warnAboveChars | 20000 | Ask before sending a file larger than this (0 turns the warning off) |
auditbench.provider | Account default | Use a specific AI provider |
auditbench.apiUrl | Audit Bench Ai cloud | Point at a different server (self-hosted setups) |
Privacy in the editor#
- The extension sends the whole file you review, not just a diff. The first time, it explains this and asks you to confirm.
- It warns you before sending files that look like secrets, such as
.envfiles or keys. - Nothing is sent until you run a review, unless you turn on review on save.
See Security and data for what happens to the code after that.