Aikido Security downloads statistics

Aikido Security Extension for Jetbrains IDE

Secure code as it’s written (and generated). Real-time static analysis (SAST), secrets, and open-source dependency (SCA) scanning, plus AI AutoFix for one-click fixes so you can address issues before they reach PRs.

Requirements

• Free Aikido Account

What it does

• Real-time scanning on open/save for code security problems, secrets, and open source dependency vulnerabilities. Findings appear inline, in sidebar and with hover details for fast triage. • AI AutoTriage noise reduction: Aikido prioritizes and de-emphasizes issues based on reachability/ and impact. • AI AutoFix in the IDE: When a fix is available, preview and apply a safe change for supported SAST and SCA findings, without leaving VS Code. • Policy-aware and custom SAST results in the IDE ensure workspace severities, ignores, and Aikido-defined custom SAST rules are applied so developers see the most relevant issues first.

Usage

Install & authenticate

• Install the Aikido extension. • Connect to Aikido by entering your PAT • Create a token in Aikido and paste it when prompted. • You’re ready to scan! Issues will be highlighted as you edit.

Scanning

The integration scans your codebase for secrets, API keys, SAST code issues and open-source dependency vulnerabilities. It runs scans whenever you open or save a file.

Every time you make and save changes in a file, a scan runs. If any issues are detected, they are highlighted in the editor and Aikido sidebar. When you hover over a detected SAST issue, additional context about the problem is provided.

Aikido AI AutoFix and AutoTriage

For supported SAST and SCA issues, Aikido will provide the option to assess the issue’s impact with AI AutoTriage, and optionally apply a code fix with AI AutoFix. This fix is applied directly in IDE.

How to test this extension

If this is your first time using this extension and you want to explore its capabilities, we suggest testing it with our example file below.

• Create a folder on your local machine. • Open this folder in your IDE. • Within this workspace, create a file containing the code you want to scan. • Save the file. • Any identified issues will appear as highlights in the editor and in the Problems panel below.

Below you can find an example index.js file that can be used to verify if the extension is working correctly, it should detect one SAST issue (SQL injection) and one exposed secret (Stripe Access Token).

const app = {}

app.get("/payments", (req, res) => { const PW = "sk_live_fakestripeapikeyleaked12" res.status(200).send(STRIPE_API_KEY) })

app.get("/user", (req, res) => { const username = req.query.username const unsafeQuery = SELECT * FROM users WHERE username = '${username}' db.query(unsafeQuery, (err, result) => { res.status(200).send(result) }) })

Commands

Execute Aikido Plugin Actions by clicking on the Aikido icon in the lower left.

• Connect to Aikido: Enter an access token to connect with the Aikido Platform. • Disconnect from Aikido: Clears your access token. • Reload rules: Fetches all SAST rules from the Aikido Platform. Useful when you add new custom rules.

How does the extension perform scans on a repository

The integration does three types of scanning: secret, SAST and open-source dependency scanning. It uses Aikido-defined rules, supplemented by any custom rules you add to Aikido. The integration then processes any results to check for false positives or ignored issues.

How does the extension connect to Aikido

Using the access token that you provided, the extensions will connect and detect the matching repository in Aikido using the Git remote URL or the name of the project folder.