Codebase X-Ray

AI-assisted software development makes it possible to create applications much faster, but speed does not guarantee safe or reliable code. An application may look polished, compile successfully, and run locally while still containing hidden problems such as hardcoded credentials, security weaknesses, broken layouts, poor error handling, unfinished code, and missing automated tests. These issues can easily be missed during a quick manual review. Codebase X-Ray addresses this problem through a lightweight project-auditing workflow inside VS Code. The extension scans a workspace and combines four types of analysis: security scanning, quality scanning, testing scanning, and browser-based visual scanning. It detects common security patterns such as hardcoded API keys and passwords, dangerous HTML rendering, insecure endpoints, weak client-side authorization, and wildcard CORS. It also identifies quality issues such as console statements, TODO/FIXME comments, empty catch blocks, fetch calls without error handling, and excessively large files. The visual scanner uses Playwright to identify problems such as horizontal overflow, elements outside the viewport, text overflow, broken images, and mobile layout failures. The project also checks for automated tests and calculates a simple project health score based on issue severity. Developers open a project in VS Code, run a scan, inspect findings through the dashboard, and jump directly to the affected file and line. For an issue, Codebase X-Ray can generate a structured IBM Bob task containing the issue context, location, recommended fix, and verification steps. Bob AI/Bob IDE can then be used to assist with the remediation. After the changes are made, the developer rescans the project to identify fixed, remaining, or newly introduced issues. The project is primarily intended for developers and teams using AI-assisted coding workflows. Its distinctive approach is combining code-level checks, browser-level visual checks, project health scoring, and AI-assisted remediation into one visible workflow. The included CampusConnect demo application intentionally contains several flaws, allowing the extension to demonstrate the complete scan-to-fix-to-verify process.