Integrations FAQ

Last updated: Oct 21, 2026

---

This page answers frequently asked questions about the Fluid Attacks API and IDE plugin. Many of them are about privacy in the features that use Claude Sonnet.

API

How can I start using the platform API?

To start with the API, read the articles in the Use the API section of this documentation. To send requests to the API, you must know the GraphQL language.

What is the API's structure?

The API uses a schema-first approach with Ariadne.

IDE extension

What technology do you use to generate the fixes?

To generate fixes, Fluid Attacks uses large language models (LLMs). LLMs are artificial intelligence models for advanced text processing and generation. LLMs learn from very large databases. They can create natural language content and even code with accuracy and consistency.

Which LLM provider for the plugin is used?

Anthropic's Claude Sonnet 4 in Amazon Bedrock.

How does it work, and what is the role of Claude in your plugin?

In the Fluid Attacks IDE plugin or extension, Claude Sonnet gives code-based remediation guidelines (the "Custom fix" function) and automatic code fixes (the "Autofix" function). First, the plugin gets a code fragment from the selected vulnerable file. Then it sends this fragment securely to the Claude Sonnet 4 instance that Amazon Bedrock hosts. Claude Sonnet gives a response with remediation suggestions.

What is the code access level of Claude?

Claude Sonnet interprets the code that it gets with the context of the function or class, specifically the line of code that has the vulnerability. This AI model does not know the full source code or the business logic of the application. Its access to the code is limited to a small piece that represents a specific function.

Does Claude retain data, and for how long?

Amazon Bedrock hosts the Claude Sonnet 4 model. Amazon Bedrock does not keep data.

What is the data privacy with Claude?

Fluid Attacks knows that the confidentiality and security of the code of its customers are important. When Fluid Attacks uses AI for vulnerability management, it complies with strict privacy and data security policies. These are the key policies of Amazon Bedrock, which hosts the Claude Sonnet 4 model that Fluid Attacks uses:

• Amazon Bedrock hosts the supported foundation models (FMs) directly on infrastructure that AWS owns and manages. Model providers cannot access customer data, such as prompts and continuations, or the service logs of Amazon Bedrock.
• Amazon Bedrock does not log or store the prompts and completions of customers. It does not use them to train AWS models, and it does not give them to third parties.
• Amazon Bedrock protects data at rest and in transit with encryption.

Does your company use the plugin for internal usability?

Fluid Attacks pentesters use this tool in their daily vulnerability reporting work.

What information does the plugin take?

The Fluid Attacks IDE extension uses all the available information of the repositories in the Scope section of the platform.

What version of AI is used?

Fluid Attacks uses the Claude Sonnet 4 model.

In which IDEs is the extension available?

The Fluid Attacks extension is available in Visual Studio Code (VS Code) and Cursor, and a plugin is available for IntelliJ IDEA. VS Code is one of the most used integrated development environments (IDE) in the industry. Cursor is more recent, but many developers already use it. Fluid Attacks selected these IDEs because they are popular, extensible, and reliable in the development community.

Why does the IDE extension not check for vulnerabilities?

It is technically possible to test from the IDE, as several automated tools do. But this testing is frequently not rigorous enough for security. For example, the management and security teams cannot control the security testing, and the developers select the test frequency.

What should I do if, once I install the extension, I have problems loading the window to enter the API Token?

On VS Code:

1. Select View > Command Palette...
2. Type the command Fluid Attacks: Set Fluid Attacks token.
3. When you select the command, a box opens where you can paste the token.

On Cursor:

1. Type >Fluid Attacks: set Fluid Attacks token in the input bar.
2. Select the command.
3. When the prompt opens, paste the token.