Docs/Build/SDKs

SDKs and extensions.

Runtime agents that see what static analysis cannot, editor integrations that surface findings where code is written, and a Terraform provider for configuration as code.

IAST 6 runtimesIDE VS Code · JetBrainsIaC Terraform providerUpdated September 2026

IAST runtime agents

The IAST agents instrument request handling inside your application — sources, propagators, sanitisers and sinks at runtime — and report confirmed dataflows to the platform, where they corroborate or contradict static findings on the same code. A static SAST finding with a matching runtime trace becomes an observed reachability edge.

Runtime	Package	Notes
Python	`securityvault_iast`	WSGI/ASGI middleware, hooks, evaluator, optional RASP mode.
Node.js	`@securityvault/iast-agent`	Express integration (optional peer dependency).
Java	Maven artifact	Java agent for servlet and Spring applications.
Go	`sdks/go/iast`	Middleware for net/http and common routers.
.NET	`SecurityVault.IAST`	ASP.NET Core middleware.
Ruby	gem	Rack middleware.

Agents report, they do not decide. An agent has an ingest token scoped to the application; it cannot read findings, change status or reach the database.

IDE extensions

The VS Code extension and the JetBrains plugin scan the file being edited through POST /api/v2/developer/ide/scan-file and show findings inline with the remediation template when one exists. They authenticate with the same device flow as the CLI.

Terraform provider

terraform {
  required_providers {
    esos = { source = "securityvault/esos" }
  }
}

provider "esos" {
  api_url = "https://app.securityvault.io"
  org_id  = var.org_id
}

Manage integrations, policies and organisation settings as code; the provider talks to the same /api/v2 surface with the same authorisation.

Versioning and support

SDKs are versioned independently of the platform and follow semantic versioning. Breaking changes to the ingest contract are announced in the changelog with a migration note before the old contract is retired.