IDE extensions

Last updated: Oct 27, 2026

---

At this time, Fluid Attacks has extensions for three integrated development environments (IDEs): Cursor, Visual Studio Code (VS Code), and IntelliJ IDEA. The IntelliJ IDEA extension also works in other JetBrains IDEs, for example, Android Studio, AppCode, and Aqua. With these extensions, your developers can manage vulnerabilities in their coding environment.

The three extensions have almost the same functions to find and fix vulnerabilities from the IDE. There is one difference at this time: the IntelliJ IDEA extension does not show color-coded status indicators on the vulnerable lines of code. The Cursor and VS Code extensions show these indicators.

Key capabilities

Visualization of vulnerabilities

With the three extensions, developers can see the vulnerabilities that Fluid Attacks reports, directly in the IDE. After you set an API token, the extension shows a list of the weaknesses in your code. It also marks the vulnerable files in the explorer and underlines the lines of code where each vulnerability is present.

AI-generated remediation

The three extensions use AI to help developers fix vulnerabilities faster:

• Custom Fix: Generates a step-by-step guide about how to fix the vulnerable code.
• Autofix: Generates code fixes automatically. In Cursor and VS Code, the fix is a suggested pull request. In IntelliJ IDEA, the extension applies the fix directly to the file.

Requesting reattacks

With the three extensions, you can request reattacks from the IDE to examine if your fixes correct the vulnerabilities. To request a reattack from a vulnerable file, use the reattack icon or the right-click menu.

Access to vulnerability documentation and platform links

The three extensions have direct links to the Fluid Attacks database (DB/Criteria) and to the vulnerability report on the Fluid Attacks platform. They also have a See Finding description function. This function opens documentation in the IDE with the attack vector, threat, severity score, and average remediation time.

Right-click options menu on vulnerable lines

When you right-click a vulnerable line of code, the three extensions show a menu with the most common actions for that vulnerability:

• Apply suggested fix (Autofix)
• Go to Criteria (opens the entry of the vulnerability in the Fluid Attacks database)
• Request reattack
• See Finding description

Dependency update options

With the three extensions, you can see the update options for vulnerable dependencies that software composition analysis (SCA) detects. To see the available update options, hover over a vulnerable dependency and click the wrench icon.

Status indicators and refresh

The three extensions have a refresh button. Cursor and VS Code also change the color of the vulnerability underlines to show their status. IntelliJ IDEA does not have these color-coded indicators at this time. The colors have these meanings:

• Blue: Reattack requested.
• Yellow: "Temporarily accepted" treatment applied.

Comparative summary

This table compares the functions of the IDE extensions of Fluid Attacks: