Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 15 additions & 9 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -38,11 +38,11 @@

## Overview

Checkmarx continues to spearhead the shift-left approach to AppSec by bringing our powerful AppSec tools into your IDE. This empowers developers to identify vulnerabilities and remediate them **as they code**.
Checkmarx continues to spearhead the shift-left approach to AppSec by bringing our powerful AppSec tools into your IDE. This empowers developers to identify vulnerabilities and remediate them **as they code**.
The Checkmarx Visual Studio Code extension integrates seamlessly into your IDE, identifying vulnerabilities in your proprietary code, open source dependencies, and IaC files. The extension offers actionable remediation insights in real-time.

- **Checkmarx One** allows developers to access the full functionality of their Checkmarx One account directly from their IDE, eliminating the need for developers to use the CxOne platform. With this integration, you can initiate new scans, review scan results, and receive guided remediation advice. Checkmarx offers comprehensive details about each vulnerability, including remediation recommendations, examples of effective fixes, and AI-generated code suggestions. The extension also lets you quickly navigate from a vulnerability to the associated source code, making it easier to identify and address problematic areas.

This tool requires authentication, using credentials from your Checkmarx One account.

### Key Features
Expand All @@ -53,12 +53,12 @@ This tool requires authentication, using credentials from your Checkmarx One acc
- Utilize the AI Security Champion feature for code remediation suggestions.
- **Pre-commit Scans**
- Run a new scan directly from your IDE before committing your code, or import scan results from your Checkmarx One account.
- **Checkmarx Static Analysis Security Auto Scanning**
- **Checkmarx Static Analysis Security Auto Scanning**
- Perform local scans every few seconds on supported language files.
- Instantly scan code generated by Copilot.
- Hover over lines of code to view remediation advice and apply Quick Fixes.
- **Local SCA Scanning**
- Perform local scans looking for Open Source packages with known vulnerabilities
- Perform local scans looking for Open Source packages with known vulnerabilities
- **Checkmarx IAC Security Auto Scanning**
- A free tool that requires no Checkmarx account.
- Scans your code automatically, running in the background whenever you open or save an IaC file.
Expand All @@ -67,27 +67,31 @@ This tool requires authentication, using credentials from your Checkmarx One acc
- Adjust the severity, update the state, and add comments directly from the VS Code extension.

## How To Videos

- **Installation**
![](https://raw.githubusercontent.com/Checkmarx/ci-cd-integrations/main/.images/vscode_installation_and_initial_setup.gif)
![](https://raw.githubusercontent.com/Checkmarx/ci-cd-integrations/main/.images/vscode_installation_and_initial_setup.gif)

- **Running a Scan**
![](https://raw.githubusercontent.com/Checkmarx/ci-cd-integrations/main/.images/vscode_running_scan.gif)
![](https://raw.githubusercontent.com/Checkmarx/ci-cd-integrations/main/.images/vscode_running_scan.gif)

- **IAC Security Auto Remediation**
![](https://raw.githubusercontent.com/Checkmarx/ci-cd-integrations/main/.images/vscode_kics_auto_remediation.gif)
![](https://raw.githubusercontent.com/Checkmarx/ci-cd-integrations/main/.images/vscode_kics_auto_remediation.gif)

## Prerequisites

- **IAC Security Auto Scanning:**
You must have Docker installed and running in your environment
You must have Docker installed and running in your environment

- **For Checkmarx One:**
You need to have a Checkmarx One account and be able to generate an API key for your account. To create an API key, see [Generating an API Key](https://checkmarx.com/resource/documents/en/34965-118315-authentication-for-checkmarx-one-cli.html#UUID-a4e31a96-1f36-6293-e95a-97b4b9189060_UUID-1e7abdfa-77eb-2a6c-f12a-c812a1e1dcf7).
You need to have a Checkmarx One account and be able to generate an API key for your account. To create an API key, see [Generating an API Key](https://checkmarx.com/resource/documents/en/34965-118315-authentication-for-checkmarx-one-cli.html#UUID-a4e31a96-1f36-6293-e95a-97b4b9189060_UUID-1e7abdfa-77eb-2a6c-f12a-c812a1e1dcf7).

## Initial Setup

- For **IAC Security Auto Scanning**, no configuration is needed, just install the extension, and start getting results!
- For **Checkmarx One**, you need to configure your account info. See documentation [here](https://checkmarx.com/resource/documents/en/34965-123549-installing-and-setting-up-the-checkmarx-vs-code-extension.html).

## Documentation

- [Installation](https://docs.checkmarx.com/en/34965-123549-installing-and-setting-up-the-checkmarx-vs-code-extension.html)
- [Reviewing Results](https://checkmarx.com/resource/documents/en/34965-68743-visual-studio-code---checkmarx-one--ast--results.html)
- [IAC Security Auto Scanning](https://docs.checkmarx.com/en/34965-68744-using-the-checkmarx-vs-code-extension---kics-auto-scanning.html)
Expand All @@ -101,11 +105,13 @@ We appreciate feedback and contribution to the VsCode extension! Before you get
- [Checkmarx Code of Conduct](docs/code_of_conduct.md)

<!-- LICENSE -->

## License

Distributed under the [Apache 2.0](LICENSE). See `LICENSE` for more information.

<!-- CONTACT -->

## Contact

Checkmarx - Integrations Team
Expand Down
Loading