Skip to main content

Spectra Code

Spectra Code is a Visual Studio Code extension that helps users identify and assess vulnerable dependencies early in development, both in their projects and in enabled VS Code extensions - all directly within VS Code.

It uses rl-protect internally to connect to the ReversingLabs APIs and scan supported manifest files from popular package ecosystems such as npm and PyPI. The analysis results are displayed in manifest files and in the sidebar to provide clear visibility into risks across multiple SAFE Assessment categories, including Malware, Tampering, Vulnerabilities, Secrets, Hardening, and Licenses. This helps developers track third-party risks and maintain project security and compliance without leaving the editor.

To reduce noise in larger projects, specific risk categories (Vulnerabilities, Hardening, Secrets, Licenses) can be disabled in rl-profile configuration, preventing issues in those categories from being detected or reported. The profile is located at project/.rl-protect/rl-profile.json and is applied on the project level. Each project has its own profile, whether it's one of several in the same workspace or in a separate workspace entirely.

In this guide, you'll learn how to configure the Spectra Code extension, understand analysis results, and manage findings effectively.

Prerequisites​

To start working with Spectra Code, you'll need the following:

  • Visual Studio Code (latest stable release recommended)
  • Latest version of Spectra Code
  • A Spectra Assure account (Community or Portal)
  • An internet connection, since analysis data is fetched from the ReversingLabs APIs

Spectra Code requires a user token to access either the Community API or the Portal API and retrieve analysis reports for project dependencies. You can use the extension with:

  • Community tokens: Community Free and Community+
  • Portal tokens: Essentials and Enterprise
Tiers

For the differences between the two token types and more information on tiers and rate limits, refer to the API tiers guide docs.

  1. Create a Spectra Assure Community account from the official page. You can use your existing Google or GitHub account to sign in for free.
  2. Generate a token from your profile on the Spectra Assure Community. This token will be used for fetching analysis data from the Community API.
  3. Copy the token and store it in a safe place. This is the only way to obtain the token you just generated.

Authentication​

When running the extension for the first time, you'll be prompted to enter your user token.

Your Spectra Code token is encrypted and stored securely in VS Code, so you only need to enter it once. This token is never shared with other extensions.

If you use a Portal token, the extension will ask you to enter the domain name of your Portal instance (e.g., my.secure.software/demo or {region}.secure.software/demo).

Once entered, your token is validated. A success message shows the active token type, while a failure message indicates the token is invalid.

You can update your token at any time by using the Update User Token command if:

  • your token has expired
  • you revoked the token in your Community profile and generated a new one
  • you want to switch from using a Community token to a Portal token, or vice versa
Switching tokens

Changing tiers within the same service does not require a new token. You can continue using the same Community token when switching between Community Free and Community+, or the same Portal token when changing between Portal tiers.

Generating a new token does not reset your monthly API usage, as usage is tied to your user account. However, switching between Community and Portal tokens changes your API usage from the Community API quota to the Portal API quota, and vice versa.

Deleting your token locally (via the Delete User Token command) does not revoke it server-side, and uninstalling or disabling the extension does not delete or revoke it either. To fully invalidate a token, use Delete User Token to remove it from VS Code, then revoke it from your Community or Portal profile.

Commands​

To run the Spectra Code commands, type Ctrl+Shift+P followed by Spectra Code into the VS Code navbar and select any of the available commands.

CommandFunctionality
Create AccountOpens a page where you can create a Spectra Assure Community account.
Update User TokenOpens a dialog to update the current revoked or expired user token or change the token type between Community and Portal. For Portal tokens, the extension will ask you to enter your Portal instance domain name (e.g., my.secure.software/demo or {region}.secure.software/demo).
Delete User TokenDeletes the currently stored user token.
Analyze DependenciesManually triggers a reanalysis of dependencies. Only consumes quota for data not already in the cache.
Analyze ExtensionsManually triggers a reanalysis of enabled VS Code extensions tied to your VS Code profile. Only consumes quota for data not already in the cache.
Invalidate CacheClears saved analysis data so the next scan fetches fresh results from the Community API.
Refresh CacheImmediately fetches the latest analysis data and updates the cache.
Open WalkthroughOpens the Spectra Code walkthrough.
Quota consumption

Analysis results are kept up-to-date with hourly refreshes while VS Code is open, retrieving the most recent data from the Community or Portal API (depending on your token) and using part of your monthly API quota.

Larger projects require more API calls. If a manual reanalysis or a change to a manifest file matches data already in the cache, no new API call is made and no additional quota is used.

Spectra Code provides the RL view to navigate problematic dependencies in your projects, accessed via the RL icon at the bottom of the left-hand sidebar. It is divided into two categories:

  • Analyzed dependencies - shows results for vulnerable dependencies detected in your project manifest files. Selecting a dependency opens the manifest file in which it's defined, with the cursor positioned on that dependency
  • Analyzed extensions - shows results for vulnerable dependencies detected in enabled VS Code extensions tied to your VS Code profile. Selecting a dependency opens its Community report in your browser

Clicking the three dots in the upper-right corner of the sidebar allows you to choose to remove only one of the two categories from view.

In RL view, dependencies under Analyzed dependencies are organized by manifest file and SAFE Assessment category: Malware, Tampering, Vulnerabilities, Secrets, Hardening, and Licenses. An additional Unknown category covers packages that have no assessment available, typically because the package version has since been removed or unpublished from its source registry. For each manifest file, the RL view shows a summary of how many assessment categories are failing.

Dependencies under Analyzed extensions are organized only by SAFE Assessment category, since they aren't tied to a manifest file.

Viewing assessment results​

On startup or when opening a folder, Spectra Code scans all supported manifest files and all extensions tied to your VS Code profile, fetching the relevant analysis data and displaying results in the sidebar and under the Problems tab. Each detected issue (warning or fail) is underlined in the manifest file. Saving changes to a manifest file triggers a new analysis.

Hover over a problematic dependency version in its manifest file to view its Spectra Code assessment summary, package information, and a link to its Community report. The hover window also provides the following options:

  • View problem - opens a pop-up showing the total number and types of issues detected for the selected dependency version, and lets you switch between other flagged dependencies in the same manifest file
  • Quick fix - opens a pop-up listing available versions for the dependency, with issue information for each, so you can select one to update to. This option is also available from the Problems tab: open the manifest file and right-click on the issue to uncover which dependency it refers to and which versions of this dependency are available for the potential upgrade

Quick start guide​

In this basic workflow, we're setting up the Spectra Code extension and using it to scan a folder in a new VS Code workspace.

1. Set up the extension​

When you install the extension to your VS Code, you'll be prompted to either create an account or enter your user token.

Let's say you're using a Community Free token. To use the extension, you only need to enter the token generated on your Community profile.

Once you enter it, your token is validated. If your token is valid, you'll get a success message with the active token type.

2. Add a folder to your workspace​

Spectra Code automatically analyzes all folders in the workspace and all enabled VS Code extensions tied to your VS Code profile.

If no folders are open in your workspace, open the folder whose contents you want to analyze. This is done by selecting File > Add Folder to Workspace in your VS Code navbar.

3. View analysis results​

To open a detailed view of your analysis results for a vulnerable dependency, first click on the dependency under Analyzed dependencies. This opens a manifest file where it's detected.

In the manifest file, hover over the dependency version and select View problem to see the total number and types of issues detected.

tip

By default, VS Code opens files in the currently focused tab group. To reveal a file if it’s already open elsewhere, set "workbench.editor.revealIfOpen": true.

4. Apply fixes to vulnerable dependencies​

If a dependency has issues, hover over it in the manifest file and select Quick fix to see available versions you can update to, along with issue information for each. Select the version you want to upgrade or downgrade to. The version change is immediately visible in the manifest file, but you should save the file to apply the changes.

If you need more details on a version before updating, use the link to the Community report shown in the hover window. The link is in the following format: package@version.