Using VIfix
Scanning local projects
Local scans read the project straight from disk. Nothing is uploaded.
Start a scan#
Open Local Folder Scanner (or the Scan Control Center on the dashboard), choose your project's root folder, and click Run scan. Each scan counts once against your plan.
What is scanned#
| Files | Checks |
|---|---|
| JavaScript / TypeScript (JS, TS, JSX, TSX) | Secrets, SQL and command injection, OWASP route issues, XSS sinks, weak crypto |
| Supabase / SQL migrations | Row Level Security review of every table and policy |
| Python | SQL built with string formatting, shell injection, secrets |
| Config, shell scripts, .env files | Secrets |
What is skipped#
node_modules, build output, lockfiles and minified files- Binary files and files over 1 MB
- Anything listed in the project's root
.gitignore - Symlinks (VIfix never follows a link out of the project)
Test files and fixtures are skipped by the code-pattern rules but are still checked for secrets.
How secrets are shown#
Secrets are never displayed in full. When a secret is found, it's masked in every snippet from that file, and .env values are always masked.
Gitignored .env files
A gitignored
.env is the right place for secrets, so its values aren't reported. The exception is a secret-looking value with a browser-exposed prefix such as NEXT_PUBLIC_, because the bundler ships those to every visitor.Want to scan code on GitHub instead? See Scanning GitHub repos.