OffShield AI
Contact salesDownload

OffShield is your security agent for shipping safe software.

Download for VS Code Get a Pro license →
OffShield in VS Code
Files with findings
payments.js4 issues, just now
auth.jsClean
wallet.jsClean
.env.exampleClean
Scan payments.js for security issues
Checked 4 rules in 12ms
CWE-798 Secret key in source
CWE-89 SQL injection hazard
CWE-78 Command injection hazard
FINTECH-LOGIC-01 Amount not validated
payments.jsauth.js
1const stripe = require('stripe')('sk_live_51Hx9aQ2eZvKYlo2C0nQp7Wd');
2async function charge(user, amount) {
3 db.query("SELECT * FROM users WHERE id=" + user.id);
4 child_process.exec("convert " + req.file);
5 balance -= amount; // amount could be negative
6}

Security that keeps up with you

Scans as you type.

Issues are underlined in your editor the moment the code is written, not after the pull request.

See what it catches →
● db.query("..." + id)
db.query("...", [id])

Knows money code.

Rules written for payment and wallet logic that generic scanners skip.

Explore fintech rules →
● balance -= amount
if (amount > 0) balance -= amount

Always up to date.

New rules arrive from the OffShield cloud when your editor starts. No reinstall.

Get started →
Rules synced
AKIA… key pattern added
ghp_… token pattern added
CWE-798 sk_live_…
CWE-798 paystack_sk_…
CWE-798 AKIA… (AWS)
CWE-798 ghp_… (GitHub)

Leaked keys, caught early

Stripe, Paystack, AWS and GitHub keys, and private keys in JSON, are flagged before they reach a commit.
Install OffShield →

Bugs that cost money

SQL injection, command execution, eval(), and payment logic with no positive-value check.
Get a Pro license →
CWE-89 SQL built from user input
CWE-78 Shell command from variable
CWE-94 eval() call
FINTECH-LOGIC-01 amount not validated
1. Download the .vsix file
2. Extensions → ... → Install from VSIX
3. OffShield: Activate License

Running in two minutes

Install from the command line or from the Extensions panel, then activate your key.
code --install-extension offshield-ai-ide-1.0.1.vsix

One payment, 30 days of protection

Pay securely on Bachs and your license key is emailed to you. Each key is valid for 30 days from purchase.

30 days per license
  • Live scanning for CWE and fintech rules
  • Automatic rule updates for 30 days
  • Key kept in your editor's encrypted storage
Buy Pro license

Questions

Does my code leave my machine?

No. Scanning runs locally in your editor. Only your license key is sent to OffShield to check it is valid, and the editor downloads the latest rules.

How long does a license last?

30 days from the day you pay. When it expires, scanning stops until you buy a new key.

Which editors are supported?

VS Code 1.75 or newer and VSCodium, on Windows, macOS and Linux.

I paid but did not get my key.

Check your spam folder, then email support@offshieldsecurity.org with the email you paid with and we will resend it.

Try OffShield now.
Download for VS Code