# Real-time SAST, Secrets and IaC scananing in IDE

The Aikido IDE plugin helps you catch security issues the moment they’re introduced. Every time you open or save a file, Aikido runs a quick scan in the background and highlights problems directly in your editor.

<figure><img src="https://help.aikidogov.us/_assets/e2c2a9cc837e/secret_flag.gif" alt=""><figcaption></figcaption></figure>

#### What It Scans

Aikido performs two types of scans in real time:

* SAST (Static Application Security Testing): Detects insecure coding patterns, potential injections, unsafe deserialization, and other code-level vulnerabilities.
* Secrets: Finds exposed credentials such as API keys, passwords, or tokens.
* IAC: (Infrastructure as Code): Detects cloud and infrastructure misconfigurations in Terraform, CloudFormation, Dockerfiles, and similar files.

{% hint style="info" %}
IaC scanning is available in VS Code (and variants like Cursor and Windsurf) and JetBrains IDEs. It isn't available in Visual Studio or Eclipse.
{% endhint %}

#### How It Works

When you open or save a file, Aikido scans the code using the same analysis engine as the Aikido platform. Scans run locally, so your code doesn't leave your machine.

Detected issues appear:

* Inline, underlined or highlighted in the editor.
* In the Aikido sidebar, grouped by severity and category.
* In the Problems panel, for quick navigation.

Hover over any finding to see context and remediation details. For supported findings, you can [analyse using AI Autotriage or apply an AI AutoFix](https://help.aikidogov.us/ai-and-dev-tools/ide-plugins-overview/features/aikido-ai-in-ide) to safely patch the issue without leaving your IDE.