Microsoft DevSkim

What Microsoft DevSkim is

Microsoft DevSkim is a free, MIT-licensed toolkit for security linting and static source-code analysis. It provides IDE extensions, language analyzers, and rules to help developers identify and address security vulnerabilities early. The toolkit includes built-in rules and supports custom rules using JSONPath, XPath, and YmlPath. Listed language support includes C, C++, C#, Cobol, Go, Java, JavaScript/TypeScript, and Python, among others. Its cross-platform .NET CLI analyzes files and directories and can be installed as a global tool or obtained as platform-specific binaries for Windows, macOS, and Linux. A C# library is also available for embedding analysis in other tools. Results can be emitted as SARIF, JSON, or text; the CLI can apply suggested fixes from SARIF results and add suppression comments. The project lists extensions for Visual Studio Code and Visual Studio, and supports CI/CD in self-hosted environments. DevSkim is licensed under the MIT License. Support is limited to GitHub issues and project wiki resources; vulnerability reports should be sent privately to Microsoft’s Security Response Center rather than posted publicly.