Skip to content

VS Code Quick Start

Use this guide when developers need workspace scans, Problems diagnostics, report history, comparison, and navigation from findings to source.

Typical time: 10 minutes. Requires VS Code 1.92+, Java, OpenGrep, the VSIX artifact, and an issued license.

1. Confirm the deployment requirements

Have the VSIX release artifact and an issued postq.lic available. This deployment requires Visual Studio Code, Java, and OpenGrep.

2. Install prerequisites

Use your organization's approved software distribution process, or install from the publisher resources:

Then run the supplied pre-install check:

.\postq-code-scanner-preinstall-check.ps1 -Profile vscode

If PowerShell blocks the script, see PowerShell blocks the prerequisite checker.

bash ./postq-code-scanner-preinstall-check.sh --profile vscode

IDE discovery is advisory. Confirm the extension is installed even when the checker can find the VS Code launcher.

If OpenGrep download is blocked by Microsoft Edge, SmartScreen, or Windows Defender, see OpenGrep download is blocked by Microsoft Edge, SmartScreen, or Defender.

For platform notes and supported versions, see Prerequisites.

3. Install the extension

  1. Open Extensions in VS Code.
  2. Select the Extensions menu, then Install from VSIX....
  3. Choose postq-code-scanner-vscode-<version>.vsix.
  4. Reload VS Code when prompted.

4. Activate the license

  1. Open the PostQ Code Scanner Activity Bar view.
  2. Expand Configuration.
  3. Select Activate License From File.
  4. Choose the issued postq.lic file.
  5. Confirm that Configuration shows green checks for the license, Java 11+, and OpenGrep.

5. Scan a workspace

  1. Download and extract the Java Quick Start project, or choose a representative repository.
  2. Open the extracted postq-java-quickstart directory as a VS Code workspace.
  3. Open the Command Palette.
  4. Run PostQ Code Scanner: Scan Workspace Folder.
  5. Keep the PostQ Scanner terminal open until the scan completes.

If OpenGrep is outside PATH, set postqCryptoReadiness.scanner.openGrepPath before scanning. If Java is outside PATH, set postqCryptoReadiness.scanner.javaPath before scanning.

6. Review the result

  1. Expand Reports in the PostQ Activity Bar view.
  2. Open the newest completed scan.
  3. Review Crypto Functions and Operation Groups for the detected cryptographic inventory.
  4. Open Assessment for security findings, quantum exposure, and review gaps.
  5. Select a finding to navigate to its source when the file remains in the workspace.

Reports are stored below:

<workspace>/reports/postq/scans/<scan-id>/

Success checklist

  • The scan status is complete.
  • The PostQ Scanner terminal shows exit 0.
  • The completed scan appears under Reports.
  • Scan findings appear in Problems when diagnostics are enabled.

Next: VS Code usage and settings.