Match the editor to CI

The extension runs vulnetix lsp from the same CLI your pipeline runs, with the same rules, parsers, VDB and suppression matcher. Differences come from configuration and scope, not from a second engine.

Settings and their CLI equivalents

Editor setting	vulnetix scan / vulnetix fix	Note
vulnetix.diagnostics.minimumSeverity	--severity <level>	The editor hides findings; the CLI exits 1 when one meets the level
vulnetix.sca.safeHarbourStrategy	vulnetix fix --strategy (--sca-autofix-strategy on scan)	Editor default safest, CLI default stable
vulnetix.sca.maxMajorBump	vulnetix fix --max-major-bump (--sca-autofix-max-major-bump on scan)	Both default 0
vulnetix.memory.path	The .vulnetix/ directory under --path	Both read memory.yaml suppressions
vulnetix.suppressions	none	Editor only, by design
vulnetix.sca.enabled: false	--no-sca

To keep the team on the same values, commit the resource-scoped settings:

// .vscode/settings.json
{
  "vulnetix.diagnostics.minimumSeverity": "medium",
  "vulnetix.sca.safeHarbourStrategy": "stable",
  "vulnetix.sca.maxMajorBump": 1
}

and run the matching commands in CI:

vulnetix scan --severity medium                                  # fail on what the editor shows as an Error or Warning
vulnetix fix --strategy stable --max-major-bump 1 --dry-run      # the same fix targets the quick fixes offer

CI setup is covered under CLI.

Differences that are expected

Difference	Editor	vulnetix scan
Git history for secrets	Never walked	Walked by default (--git-history, up to 500 commits and 5000 files)
Which files get code findings	Files you open	Every file under --path to --depth (default 3)
nosec comments	Not honoured	Honoured
Exit status, quality gate, malware, EOL, cooldown gates	None	--severity, --exploits, --block-malware, --block-eol, --cooldown and others
Licences, malware, SBOM, AI BOM, CBOM	Not run	Run unless skipped
Organisation quality gate	Not applied	Applied when signed in: see Quality gates

When CI reports a finding you did not see, reproduce it locally with the same command your pipeline runs.

A hard stop before commit or push

Editor findings are advisory: nothing stops you saving, committing or pushing. For a hard stop on your machine, run the CLI from a git hook or the pre-commit framework. See Local runs and git hooks.