Find and remove secrets in VS Code

9min
|
HCP
Vault
Video

The HCP Vault Radar IDE extension connects Micorosft Visual Studio Code (VS Code) to the Vault Radar service to surfaces secret exposure in directly in source code. The extension helps software, platform, and DevOps engineers discover potential secrets exposure while they actively write code. This tutorial covers installing and configuring the extension in VS Code to show engineers how Vault Radar helps prevent them from commit and leaking secrets.

Challenge

Business are constantly pushing software teams to produce code faster, potentially leading to short cuts and unintended security risks. The introduction of artificial intelligence (AI) helps accelerate teams, but at the cost of potentially introducting additional security vulnerabilites such as hard coded secrets. These secrets are often discovered after someone pushes a commit and security scanning tools complete a scan. These scanning tools break the feedback loop by forcing developers to context-switch out of their editor to view findings in separate dashboards. The separation delays remediation and allows leaked credentials to persist in repositories.

Solution

The Vault Radar IDE extension connects to the Vault Radar service, and optionally a Vault cluster to highlight secrets in the engineers IDE before they commit the secret to a version control system.

Prerequisites

A license for HCP Vault Radar.
An HCP account
A completed HCP Vault Radar scan of a connected data source that produced events such as the Scan a repository for secrets tutorial
Visual Studio Code installed

Install VS Code extension

The Vault Radar extension is available through the Visual Studio Marketplace. Third-part marketplaces such as the Open VSX Registry do not contain the extension.

Launch VS Code.
Click the extensions icon in the activity bar.
Search for HCP Vault Radar.
Click Install.
The extension's page will open and the icon will appear in the activity bar.
Click the Vault Radar icon in the activity bar.
Click Set up License.
Two options will appear under the command palette: Set License Key and Set License File.
Setting the license key in VS Code stores the license key in the extensions configuration. Setting the licese key files points the extension to a license file on your file system.
Select Set License Key.
Enter your license key in the License Key textbox and press enter on your keyboard.
When prompted, click the Reload button in the License key stored, reload to apply dialog box.
The Vault Radar extension in the primary side bar reloads. Here you can see the license details, the version of the CLI, and option to add a connection to a Vault cluster.

Check source code for secrets

Now that you have installed the extension, and added your license, you will clone an example repository that contains secrets to see how the extension works.

Open a terminal window in VS Code.

Clone the hcp-vault-radar-foundations repository in your current VS Code workspace.

$ git clone git@github.com:hashicorp-education/hcp-vault-radar-foundations.git

Change into the hcp-vault-radar-foundations directory.
```
$ cd hcp-vault-radar-foundations
```
Click the files icon in the VS Code activity bar.
Expand hcp-vault-radar-foundations in the primary side bar.
Open main.go in the VS Code editor.
Line 12 contains a hard-coded secret. With the Vault Radar extension installed, it flags the secret by adding a yellow line below the secret.
Hover the cursor over "b3stp@stw00rd3vA!".
The VS Code extension shows the:
- Type of secret found
- Line number and position of the secret
- Severity
- Whether the secret is available in Vault
Your engineers are now able to see inline contexual information about potential secret exposure before they commit the secret to version control.

Connect extension to Vault

Knowing there is potential secret exposure is a powerful option, shifting security left for your engineering teams. The Vault Radar plugin also allows your engineers to connect to a Vault server.

Open a terminal and start a Vault dev server.
```
$ vault server -dev -dev-root-token-id root
```
The dev server listens on the loopback interface at 127.0.0.1 on TCP port 8200. At runtime, the dev server also automatically unseals, and prints the unseal key and initial root token values to the standard output.
Root tokens
The dev mode server starts with an initial root token value set. Root token use should be extremely guarded in production environments because it provides full access to the Vault server.
You can supply the root token value to start Vault in dev mode for convenience and to keep the steps here focused on the learning goals of this tutorial.
Return to VS Code.
Click the Vault Radar icon in the activity bar.
Click Add Vault Connection.
In the command palette prompt, enter local in the Enter a nickname for your Vault server... textbox and press enter.
Enter http://127.0.0.1:8200 in the Enter Vault server URL... textbox and press enter.
Leave the Enter a Vault namespace... textbox emply and press enter.
Select Vault Token Authenticate using a Vault token.
Return to the terminal where you started Vault and copy the root token value.
Example:
```
hvs.mysup3radkey
```
Return to VS Code.
Enter the root token in the Enter vault authentication token... textbox and press enter.
The Vault Radar extension in the primary side bar reloads. Here you can see relevant Vault cluster details such as the URL, namepace, and auth method type.
Becuase this is a new Vault server, there are no secrets stored in Vault.
Return to the terminal where you started the Vault dev server.
Copy the token value.
Open a new terminal and export the VAULT_TOKEN environment variable to use with the Vault CLI.
```
$ export VAULT_TOKEN=hvs.YOU-ACTUAL-TOKEN
```
Export the VAULT_ADDR environment variable to use with the Vault CLI.
```
$ export VAULT_ADDR=http://127.0.0.1:8200
```
List the available secrets engines.
```
$ vault secrets list
```
The Vault dev mode server automatically mounts a KV secrets engine at the path secret.

Write the secret found in the example repository to Vault.

$ vault kv put        \
   -mount secret \
   dev/password       \
   password=b3stp@stw00rd3vA!

Example output:

====== Secret Path ======
secret/data/dev/password

======= Metadata =======
Key                Value
---                -----
created_time       2026-08-31T20:24:43.642995Z
custom_metadata    <nil>
deletion_time      n/a
destroyed          false
version            1

Return to VS Code.
Under VAULT CONNECTIONS hold the curor over Re-index Vault and click the play button.
The Vault Radar extension in the primary side bar reloads. Now you can see the dev/password key under KV Secrets.
Depending on your role, you can use the information from the extension to ensure the secret is not leaked, or rotate the secret if someone already commited it to version control.

Knowledge checks

A quiz to test your knowledge.

Where is the HCP Vault Radar extension available for installation?
🔘 The Open VSX Registry
🔘 The JetBrains Marketplace
🔘 The Visual Studio Marketplace
🔘 The GitHub Marketplace
❌ The Open VSX Registry
❌ The JetBrains Marketplace
✅ The Visual Studio Marketplace
❌ The GitHub Marketplace
What information does the Vault Radar extension display when you hover over a detected secret in the editor?
🔘 The secret value, expiration date, line number, and Vault path
🔘 The type of secret, line number and position, severity, and whether the secret is available in Vault
🔘 The commit history, author, severity, and recommended rotation policy
🔘 The file name, secret hash, scan timestamp, and Vault namespace
❌ The secret value, expiration date, line number, and Vault path
✅ The type of secret, line number and position, severity, and whether the secret is available in Vault
❌ The commit history, author, severity, and recommended rotation policy
❌ The file name, secret hash, scan timestamp, and Vault namespace
Why does connecting the Vault Radar extension to a Vault cluster benefit engineers who detect a secret in their source code?
Connecting the extension to a Vault cluster lets engineers see whether a detected secret is already stored in Vault, giving them the context to either prevent the secret from being committed or rotate it if it has already been leaked to version control.

Summary

In this tutorial, you installed and configured the HCP Vault Radar extension for VS Code. You installed the extension from the Visual Studio Marketplace, applied a license key, and used the extension to detect a hard-coded secret in example source code.

You then connected the extension to a local Vault dev server, stored the detected secret in Vault, and used the extension to confirm the secret's location. Your engineering teams now have the context they need to prevent secrets from reaching version control or to rotate credentials that have already been committed.

Next steps

In the next tutorial, you will learn how to enable pre-commit hooks using the Vault Radar CLI. Using a pre-commit hook is a last resort for your engineering teaams to prevent leaked secrets from reaching version control.

Detect leaked secrets - WAF guidance on identifying leaked credentials
HCP Vault Radar CLI reference - Complete documentation for all CLI commands and options
HCP Vault Radar documentation - Overview of Vault Radar features and capabilities

Understand secret exposure

Find secrets with pre-commit hooks