Use the Contrast Visual Studio Code plugin with Contrast

In Visual Studio Code, go to the Extensions view (CTRL + Shift + X or Command + Shift + X) and search for Contrast Security.

Select Contrast IDE and select Install.

After installation, restart Visual Studio Code.

In the left navigation, select the Contrast icon ().

In the activity bar, select Contrast Settings.

Enter your API key, Organization ID and Contrast URL, . You can find these values in your Contrast profile.

Select Retrieve

If the selected source is Assess, the plugin displays this message: Application Retrieved Successfully. If the selected source is Scan, the plugin displays this message: Project Retrieved Successfully.

In Visual Studio Code, in the left navigation, select the Contrast icon ().

In the activity bar, select Contrast Settings.

In Contrast Settings, select Assess as the Source.

Select the application you want to assess and select Add.

Optionally, set the Vulnerability Refresh Cycle to manage the frequency of auto-refreshing vulnerability details.

Select Retrieve to retrieve the application list.

Select Contrast Assess.

Select the Retrieve Vulnerability tab.

Select filters and then retrieve the vulnerabilities for the configured application:

Select Run.

View results in the Vulnerability Report tab.

1. To view additional details about a specific vulnerability, select it.

   This action opens a set of tabs where you can view the details.

2. In the Overview tab, view the details for the first detected date, the last detected date, the cause for the vulnerability, and the risk associated with the vulnerability.

3. In the How to Fix tab, view remediation instructions to fix the vulnerability.

4. In the Events tab, view a summary of the events for\ the vulnerability.

   Based on the type of the event, the event status is displayed.

5. In the Http Request tab, view whether the issue is fixed.

   If it isn't fixed, the issue reappears with a status of Reported

6. In the Tags tab (), view the list of tags in the organization as well as tags for the vulnerability.

   You can also create a new tag for the vulnerability.

7. In the Mark as tab, view all the status values in the dropdown.

   Select any value and add a comment for a selected vulnerability.

8. To view the details in the Contrast web interface, select the Redirect () icon.

9. To manually refresh the displayed details, select the Refresh () icon.

View the vulnerabilities associated with the active open file in the IDE in the Current File tab.

1. In the Status bar at the bottom of the Current File tab, view the total number of vulnerabilities in the file, according to severity (Critical, High, Medium, Low, or Note).

2. View details of a specific vulnerability by selecting it. This action takes you to the line of code where Contrast found the vulnerability.

3. To view details about severity, advice, last detected date, status, and more options, hover on the line of vulnerability.

In Visual Studio Code, in the left navigation, select the Contrast icon ().

In the activity bar, select Contrast Settings.

In Contrast Settings, select Scan as the Source.

Select Retrieve. to retrieve the project list.

Select a project you want to scan and select Add.

To edit the credentials for a project:

1. Select it in the table

2. Select the Edit () icon.

3. Change the credentials and select Update.

To delete a project, select the project in the table and select the Delete () icon.

To run a scan:

1. Verify that you have the code project open in the IDE and that the project name matches the name in Contrast Scan.

   Note

   The relative path in the IDE must match what is in Contrast Scan so it can make vulnerability inferences.

2. In the activity bar, select Contrast Scan.

3. In the Filter tab, select filters for status and severity.

4. Select Run.

To view results:

1. Select the Vulnerability Report tab.

   To view details for severity, advice, last detected date, status and more options, hover on the line of vulnerability.

2. In the Current File tab, view insights about a vulnerability in the current file.

   You can select the severity levels (Critical, High, Medium, Low) in the VSCode status bar to open the Current File tab.

To view vulnerabilities for a specific project when multiple projects are open:

If you have multiple projects open in the workspace, move the project you want to view to the first position in the VS Code IDE.

This action automatically updates the Scan project select in the Contrast Settings view.