Vise — User Manual

The complete guide to using Vise. For a 2-minute start, see the Getting Started; for activating a paid license see the activation steps. This manual covers every capability and how to use it.

Vise is a multi-language SAST (static application security testing) tool that runs fully offline — your source code never leaves your machine. The same engine runs in your IDE, a Desktop app, and the CLI; your edition sets the depth, not which tool.

Contents

1. Surfaces & how they relate
2. Editions — what each unlocks
3. Installing & activating
4. Running a scan
5. Understanding findings
6. Acting on findings
7. AI configuration
8. Reports & exports
9. Custom rules
10. CI/CD
11. CLI reference
12. Enterprise depth
13. Privacy & offline guarantee
14. Troubleshooting & FAQ

1. Surfaces & how they relate

12

1. 1The Vise panel — open it from the Vise icon in the Activity Bar (left edge). Findings are grouped by severity, down to each file:line.
2. 2Right-click any finding → Explain · Fix with AI · Suppress.

One engine, one license per machine. The IDE extensions run the vise-scan engine under the hood — but you just install the extension from your IDE's marketplace: on your first scan it offers a one-click engine download (~50 MB, one-time, checksum-verified), then runs fully offline. Already have the Desktop app or CLI? The extension reuses that engine automatically. Everything is cross-platform — Windows, macOS and Linux (the Visual Studio extension is Windows-only, because Visual Studio is).

2. Editions — what each unlocks

Pricing: visesec.com/pricing. You pay for depth, not access — every surface is free to download and run at Basic depth.

3. Installing & activating

Everything is cross-platform (Windows · macOS · Linux, x64 & ARM64). Pick your surface:

Per-surface "where to find Vise after install" walkthroughs: Getting Started.

Activating Pro / Enterprise: buy on the pricing page → your key arrives by email. Fastest: the success page + email have one-click Open in Vise Desktop / Open in VS Code buttons that activate for you. Or enter the key once (Desktop Settings → License — it activates the moment you paste; IDE license-key setting; or CLI --license-key). A one-time online activation binds the key to your machine; after that, scans run offline, and the same activation covers all surfaces on that machine (Desktop, IDE and CLI share it).

Prefer not to paste a key? You can sign in with your email instead: Desktop and the IDE extensions have a Sign in with email action (CLI: vise-scan --login <you@email>) that emails you a one-click link — open it and Vise activates without a key. Full flow + Enterprise seats/CI token: the activation guide.

Find your Machine ID (needed for support / license moves): Desktop Settings → License · Vise: Show Machine ID (IDE) · vise-scan --machine-id (CLI).

4. Running a scan

123

1. 1Drop a project folder here — or pick a recent one just below.
2. 2Click Scan.
3. 3Read the Dashboard, then open Vulnerabilities to triage.

Desktop

Drop a project folder onto the window (or pick a Recent one) → Scan. Results land in the Dashboard + Vulnerabilities tabs.

IDE

• VS Code: Activity Bar → Vise icon → Findings panel; Command Palette → Vise: Scan Workspace (or right-click a folder).
• JetBrains: Tools → Vise → Scan Project (Ctrl+Alt+Shift+S); results in the Vise tool window (bottom).
• Visual Studio: Tools → Vise → Scan Solution; open the panel with Tools → Vise → Vise Panel.

CLI

vise-scan ./my-project --edition pro --format sarif --output report.sarif

Scan scope & modes

• Languages — limit with --languages csharp,typescript (Desktop: Scan Settings). Empty = all.
• Exclude — --exclude "**/test/**,**/vendor/**". Vendored libs (node_modules, vendor, bin, minified bundles, embedded frameworks) are skipped automatically.
• Application vs Library mode — Vise auto-detects whether the root is an application (fires app-tier rules like IDOR, rate-limiting) or a framework/library (suppresses app-tier rules to cut false positives). Override in Scan Settings.
• Incremental (Enterprise) — --changed-only scans only files changed in the working tree; --since origin/main scans only files changed since a ref (the PR-gate mode). Both need a git repo and turn a full scan into a seconds-long one.

5. Understanding findings

123

1. 1Pick a finding — severity, OWASP / CWE / CVSS and the risk explained.
2. 2Hit Get Fix (or Ask AI) for an AI-written fix.
3. 3Export when done — SARIF / SBOM / Jira CSV…

Each finding carries: severity (Critical / High / Medium / Low / Info), the OWASP Top 10 category, CWE id, a CVSS score, the file:line, a code snippet, and a recommended fix.

• Grouping — identical findings fold into one "message ×N" row you expand to each file:line (including cross-file taint paths).
• Desktop tabs — Dashboard (severity donut + OWASP-category split + file counts), Vulnerabilities (filterable list), Trends (history across scans).
• IDE — the Vise panel groups by severity; Critical/High open, the rest collapsed.

6. Acting on findings

Right-click a finding (IDE) or use the per-finding row (Desktop):

• Explain (all tiers) — what the issue is, why it's risky, how to fix, with OWASP/CWE links.
• Fix with AI (Pro+) — generates a fix. In the IDE it routes to your editor's AI (VS Code Language Model / Copilot Chat) — Vise ships zero in-editor AI; in the Desktop it uses the built-in local model (or cloud BYOK on Enterprise).
• Copy as AI prompt — a paste-ready prompt for any chat.
• Suppress — two kinds:
  • Inline — adds a vise-ignore comment on the line (language-aware); that finding is skipped on future scans.
  • Persistent — Desktop suppressions you can export as .suppressions.json (Enterprise) and commit to the repo so the whole team shares them.
• Quick Wins — ranks findings by impact ÷ effort (biggest risk, least work, first). Pro gets the prioritized list; Enterprise adds an AI-authored fix per item into a polished report.

7. AI configuration

Vise's AI is opt-in and used only for Explain / Fix — never for detection (detection is deterministic static analysis). Three backends:

The IDE path is different: Fix/Explain use your editor's own AI (Copilot) — Vise adds no model there. Configure all of this in Settings → AI (Desktop) / the footer "Click the gear to configure AI".

8. Reports & exports

Desktop Export (top-right), tiered by format:

CLI output is --format sarif | json | text (repeat --format for multiple).

Jira CSV import: Jira → External System Import → CSV (admin). Columns map to Summary / Issue Type / Priority / Description / Labels / Component; the External ID column (ruleId|file|line) lets a re-import update issues instead of duplicating. Direct API push is on the roadmap.

9. Custom rules (Enterprise)

Author your own detections as JSON or YAML rule packs and load them:

vise-scan . --edition enterprise --custom-rules ./my-rules.json
vise-scan . --edition enterprise --custom-rules https://rules.acme.com/v2.json   # HTTPS only
vise-scan --validate-rules ./my-rules.json    # CI pre-flight, no scan

Repeat --custom-rules to combine sources (file, directory, or HTTPS URL — 1 MB cap, HTTPS-only). Schema + examples: visesec.com/docs.

10. CI/CD (Enterprise)

The vise-scan CLI is a single, self-contained binary (Linux · macOS · Windows) — no runtime to install. CI runs require Enterprise and a machine-unbound VISE_CI_TOKEN (issued for your Enterprise account — reply to your license email or contact support to get one) — not your seat key, which is bound to one machine. Store the token as a CI secret; every recipe reads it from the environment so it never appears on the command line.

GitHub Actions, in one step (download + checksum + scan + gate + SARIF upload are handled for you):

- uses: visesec/vise-action@v1
  with:
    path: .
    ci-token: ${{ secrets.VISE_CI_TOKEN }}
    min-severity: medium
    upload-sarif: true

Prefer a raw runner? The canonical snippet pins a version and verifies the published SHA256SUMS before running the binary — never pipe an unverified binary into a pipeline.

Gate the pipeline on exit code ≥ 2 (Critical/High found). CI scans are unlimited and don't consume seats. Full cross-platform recipes — GitHub Actions, GitLab CI, Azure DevOps, Jenkins, Bitbucket, Docker, plus SARIF integration and best practices — are on the website at visesec.com/ci-cd.

11. CLI reference

vise-scan <path> [options]

Exit codes: 0 clean · 1 medium/low/info found · 2 critical/high found (CI fail) · 3 invalid arguments · 4 license failed · 5 scan error · 6 cancelled. CI auth in a CI context uses VISE_CI_TOKEN (Enterprise), not --license-key.

12. Enterprise depth — "semantic analysis"

The Enterprise tier adds cross-file taint (dataflow) analysis: it traces user input from a source (request parameter, body, header…) across functions/files to a dangerous sink (SQL, command, path, XSS…), and clears the finding when a sanitizer is on the path. It's sanitizer- and framework-aware (built-in models for Spring, Django, Express, Laravel, ASP.NET Core), with semantic confidence scoring.

Measured on the industry-standard OWASP Benchmark 1.2 (Java): F1 72.1% (Pro) / 71.3% (Enterprise, max-recall) — leading every open-source SAST that publishes on that corpus (Semgrep OSS 52%, SonarQube 44%, FindSecBugs 65%). It needs no build step (scans source directly). Full numbers and methodology: visesec.com/docs.

Also Enterprise: API-security scanning and AI-authored Quick Wins.

Team management. The license owner can add or remove members, choose which email domains may claim seats, and free seats at visesec.com/team — sign in with the email that made the purchase (a one-time link is emailed; no shared key involved).

13. Privacy & offline guarantee

• Local-first. Scanning runs entirely on your machine. No telemetry, no code upload, no account required to start.
• The only network calls are: the one-time license activation + periodic license refresh (no code, just the key + machine id), optional live CVE lookup (package names only — disable with --no-live-cve), and — only if you turn it on — cloud AI BYOK with your own key. Everything else stays offline.
• IDE Fix/Explain use your editor's AI (Copilot) — Vise sends nothing itself.

14. Troubleshooting & FAQ

Questions: support@visesec.com · docs: visesec.com/docs.