Your findings , inside your editor
The extension connects your IDE to your Portal instance and marks vulnerable lines in the code you are already reading.
From install to fix in five steps
The extension is a client for your Portal instance. Scanning stays where it belongs — on the platform — while triage and remediation happen in the editor.
Connect
Sign in to your company Portal instance with its URL and an API token.
Detect
The extension recognises the open repository and loads its findings.
Review
Browse findings by file with severity, line number and description.
Navigate
Jump straight to the affected line — it is highlighted in your code.
Remediate
Apply the suggested fix, or reject the finding as a false positive.
Security context, delivered to the code
One extension, the same behaviour in every supported IDE — connected to your own Portal instance.
Every finding for the repository you have open
The extension detects the repository in your workspace and pulls its findings from the Portal.
Vulnerable lines marked where you read them
The risk stays visible while you read or refactor the code around it.
The whole finding — and how to fix it
Everything the Portal knows about a finding, without opening a browser.
Reject false positives without leaving the editor
Developers know their code best, so they can answer back from the editor.
Two fields and you are connected
Install the extension
Search for “Whitespots Security” in your IDE, or grab it from the VS Code Marketplace, Open VSX or the JetBrains Marketplace.
Point it at your Portal
Open the Whitespots panel, click Settings and fill in two fields: your Portal URL and an Auth API token.
Open your project
The extension matches your repository to its asset in the Portal and loads the findings. Nothing else to configure.
What you need
Your instance, your data
The extension talks to one endpoint — the Portal you configure. No cloud in between, no third-party services, no source code leaving your machine. It reads the findings your Portal already produced and writes your triage decisions back.
Pick your editor and get the extension
One extension for the VS Code family — including Cursor, Windsurf, Trae, Codespaces and Gitpod — and one plugin covering the whole JetBrains suite.
Questions developers ask first
Do I need a Whitespots Portal to use the extension?
Yes. The extension is a client for your Whitespots Application Security Portal instance — it displays the findings that instance has already produced for your repository. Without a Portal URL and an API token there is nothing for it to show.
Where do the findings come from?
From the scans that run on the Portal: SAST, SCA, secret scanning, container and infrastructure checks. Results are validated on the platform, so what reaches your editor is the triaged list, not raw scanner output.
Is my source code sent anywhere?
No. The extension identifies the repository you have open and requests its findings from your own Portal instance over its API. Your code stays on your machine and in your own infrastructure.
What happens when I reject a finding?
Rejecting marks the finding as a false positive in the Portal. Reject Forever goes further: later scans still pick the issue up, but matching findings are rejected automatically based on their details, so nobody has to triage them again. Both actions sync back to the Portal with their history, so the security team sees the decision.
Which IDEs are supported?
VS Code and every editor built on it — Cursor, Windsurf, Trae, GitHub Codespaces and Gitpod — through the VS Code Marketplace or Open VSX. All JetBrains IDEs, including IntelliJ IDEA, PyCharm, WebStorm, GoLand, PhpStorm, RubyMine, CLion, DataGrip, Rider and Android Studio, are covered by a single JetBrains Marketplace plugin.
Does the extension cost extra?
No. The extensions are free to install from the marketplaces; what they require is access to a Whitespots Portal instance.
Bring your findings into the editor
The extension is free. What it needs is a Portal to read from — get a license, or let us walk you through it first.