# microsoft/DevSkim

DevSkim is a set of IDE plugins, language analyzers, and rules that provide security "linting" capabilities.

Repository: https://github.com/microsoft/DevSkim
Canonical: https://ross.abutalabs.com/products/devskim
Language: C#
License: MIT
License Family: permissive
Topics: security, sdl, linter, visual-studio-code-extension, visual-studio-extension
Last push: 2026-09-03T00:14:29+00:00

## Health v2 (maintenance only)
Score: 98/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 100, release rhythm 93, longevity 100
- inputs: {"age_days": 3682, "days_push": 0, "days_rel": 47, "gap_med": 10.0, "n_releases_24m": 23}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1004, forks 131 (observed 2026-09-03T02:15:14.978684+00:00)

## What it is
DevSkim is a Microsoft security linting framework consisting of IDE extensions, a .NET CLI, and a rule engine that flags security issues inline as developers write code. It supports many languages via regex, JSONPath, XPath, and YAMLPath rules, with plugins for Visual Studio and VS Code built on the Language Server Protocol.

## Use cases
- find security vulnerabilities in code as I type
- security linting for my repository in CI
- scan source code for hardcoded secrets and weak crypto
- write custom security analysis rules
- add secure development lifecycle checks to Visual Studio or VS Code

## When to choose
- you want inline security feedback inside Visual Studio or VS Code
- you need a cross-platform CLI security scanner covering many languages
- you want customizable rules including JSONPath/XPath/YAMLPath patterns
- you want developer education with guidance on flagged issues

## When to avoid
- you need deep taint-analysis or full SAST like CodeQL or Semgrep
- you need dynamic or dependency vulnerability scanning rather than source pattern analysis
- you use an IDE without a DevSkim plugin

## Facets
- artifact type: plugin
- maturity: active
- function: linter, security, vulnerability-scanning, code-review, developer-tools
- domain: security, developer-tools, testing
- platform: cross-platform, cli, editor-plugin, windows
- tags: security-linting, sdl, static-analysis, vscode-extension, visual-studio-extension, language-server-protocol, custom-rules, linux, macos

## Member repositories
- microsoft/DevSkim (main) score 98

## Provenance
- Observed fields: from GitHub, fetched 2026-09-03T02:15:14.978684+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T07:13:46.150954+00:00, confidence not recorded.
  - readme: https://github.com/microsoft/DevSkim (fetched 2026-09-03T02:15:14.978684+00:00, sha b0c98c4325e7)
- Data as of 2026-08-30T08:39:29.467469+00:00.