A VS Code extension + git-hook enforcement + backend orchestrator that detects insecure code, shows urgency/highlights, and locks the IDE when severity is Critical/High until a verified fix is applied.
cd /Users/youseph.e/Desktop/IBM/sentry/server
npm install # Already done
npm run devServer runs at http://localhost:3333
# Health check
curl http://localhost:3333/health
# Run the test script
node scripts/test-scan.js- Open VS Code
- File → Open Folder → Select
/Users/youseph.e/Desktop/IBM/sentry/extension - Press
F5to launch Extension Development Host - In the new VS Code window, open the demo file:
/Users/youseph.e/Desktop/IBM/sentry/demo/vulnerable.js - Save the file to trigger a scan
- Observe:
- 🔴 Red highlighting on critical vulnerability lines
- 🟠 Orange highlighting on high severity lines
- 🟡 Yellow highlighting on medium severity lines
- CodeLens "Fix with SENTRY" buttons above issues
- Problems panel with all findings
- Lock screen overlay for Critical/High findings
cd /path/to/any-git-repo
/Users/youseph.e/Desktop/IBM/sentry/hooks/install.shNow commits with Critical/High issues will be blocked!
┌─────────────────────────────────────────────────────────────────┐
│ VS Code IDE │
│ ┌─────────────┐ ┌─────────────┐ ┌─────────────────────────┐ │
│ │ CodeLens │ │ Decorations │ │ Lock Screen Overlay │ │
│ │ Provider │ │ Provider │ │ (Webview) │ │
│ └──────┬──────┘ └──────┬──────┘ └───────────┬─────────────┘ │
│ │ │ │ │
│ └────────────────┴──────────────────────┘ │
│ │ │
│ ┌─────┴─────┐ │
│ │ Scanner │←── Tier 0 (Local Regex) │
│ └─────┬─────┘ │
│ │ │
└──────────────────────────┼───────────────────────────────────────┘
│ POST /scan
▼
┌──────────────────────────────────────────────────────────────────┐
│ SENTRY Backend │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ Orchestrator │ │
│ │ ┌─────────────┐ ┌─────────────┐ ┌─────────────────┐ │ │
│ │ │ Tier 0 │ │ Tier 1 │ │ Tier 2 │ │ │
│ │ │ Regex │→ │ AI Scan │→ │ AI Scan │ │ │
│ │ │ (Always) │ │ (On Save) │ │ (On Commit) │ │ │
│ │ └─────────────┘ └──────┬──────┘ └─────────────────┘ │ │
│ │ │ │ │
│ │ ┌─────┴─────┐ │ │
│ │ │ AI Provider│ ←── IBM watsonx/Bob │ │
│ │ └───────────┘ (stubbed for demo) │ │
│ └──────────────────────────────────────────────────────────┘ │
│ │
│ ┌─────────────┐ ┌─────────────────┐ ┌───────────────────┐ │
│ │ Cache │ │ Docling Chunker │ │ Patch Generator │ │
│ │ (5min TTL) │ │ (Code Parser) │ │ (Fix Suggester) │ │
│ └─────────────┘ └─────────────────┘ └───────────────────┘ │
└──────────────────────────────────────────────────────────────────┘
▲
│ POST /scan (Tier 2)
┌──────────────────────────┼───────────────────────────────────────┐
│ Git Hooks │
│ ┌─────────────┐ ┌─────────────┐ │
│ │ pre-commit │ │ pre-push │ ← Blocks if CRITICAL/HIGH │
│ │ (required) │ │ (optional) │ │
│ └─────────────┘ └─────────────┘ │
└──────────────────────────────────────────────────────────────────┘
| Tier | When | What | AI Call |
|---|---|---|---|
| Tier 0 | Always | Local regex patterns (secrets, eval, innerHTML, SQL concat, shell calls) | No |
| Tier 1 | On file save | AI scan when Tier 0 flags OR file in sensitive path OR risky sink touched | Yes (if needed) |
| Tier 2 | On git commit/push | Full AI scan of staged diff | Yes (always) |
| Risk Type | Severity | Example |
|---|---|---|
HARDCODED_SECRET |
CRITICAL | password = "secret123" |
SQL_INJECTION |
CRITICAL | "SELECT * FROM users WHERE id=" + userId |
COMMAND_INJECTION |
CRITICAL | exec("ls " + userInput) |
CODE_INJECTION |
CRITICAL | eval("(" + data + ")") |
XSS_VULNERABILITY |
HIGH | element.innerHTML = userInput |
PATH_TRAVERSAL |
HIGH | readFile("/uploads/" + filename) |
MASS_ASSIGNMENT |
HIGH | Object.assign(user, req.body) |
INSECURE_RANDOMNESS |
MEDIUM | Math.random() for tokens |
WEAK_HASH |
MEDIUM | createHash('md5') |
Scan files for vulnerabilities.
Request:
{
"files": [{
"filePath": "src/auth.ts",
"diff": "...",
"context": "...",
"metadata": {
"language": "typescript",
"tier": 1,
"timestamp": 1706726400000
}
}]
}Response:
{
"findings": [{
"id": "uuid",
"risk_type": "SQL_INJECTION",
"severity": "CRITICAL",
"line_ranges": [{"start": 42, "end": 42}],
"why_it_matters": "...",
"suggested_patch": "...",
"verified": false,
"source": "tier0"
}],
"cached": false,
"processingTime": 127,
"tier": 1
}Generate a fix for a finding.
Health check endpoint.
| Setting | Default | Description |
|---|---|---|
sentry.serverUrl |
http://localhost:3333 |
Backend server URL |
sentry.debounceMs |
1500 |
Debounce delay for save scans |
sentry.cooldownMs |
30000 |
Minimum time between scans of same file |
sentry.enableLock |
true |
Enable IDE lock on Critical/High findings |
| Variable | Default | Description |
|---|---|---|
SENTRY_SERVER_URL |
http://localhost:3333 |
Backend URL (for git hooks) |
AI_ENABLED |
false |
Enable real AI calls |
WATSONX_API_KEY |
- | IBM watsonx API key |
- Show the vulnerable file - Point out the intentional security issues
- Save the file - Watch SENTRY scan and highlight issues
- Observe the lock screen - IDE is locked due to critical findings
- Click "Fix with SENTRY" - Show AI-suggested fix
- Apply the fix - Watch auto-rescan and unlock
- Try to commit - Show git hook blocking the commit
- Fix remaining issues - Commit succeeds
MIT