VS Code Security
Protect your development environment. Security settings, extension risks, and best practices for VS Code users.
Security Risks
Malicious Extensions
Extensions have broad access to your system and code. Malicious or compromised extensions can steal credentials, inject code, or compromise your machine.
Workspace Trust Issues
Opening untrusted code can execute tasks, run debuggers, or trigger extensions that auto-execute code.
Terminal Command Exposure
Integrated terminal history, commands, and output may contain secrets that get logged or shared.
Settings Sync Risks
Settings sync can synchronize secrets, tokens, or sensitive configurations across devices.
Recommended Security Settings
Prompts before trusting new workspaces
Security: Workspace TrustVerify extension signatures
Extensions: Verify Signature Before InstallRestrict capabilities in untrusted files
Security: Restrict ModeBe cautious about terminal command suggestions
Terminal: Integrated Shell ArgsExtension Security Checklist
- Check publisher verification badge
- Review number of downloads and ratings
- Read recent reviews for security concerns
- Check when it was last updated
- Review the permissions requested
- Look at the GitHub repository for activity
- Be cautious of extensions requesting unusual permissions
- Remove extensions you no longer use
Get Starter Scan
A secure editor is just the start. Make sure the code you write (or AI generates) is secure too.
Get Starter ScanFrequently Asked Questions
Are VS Code extensions safe?
Not automatically. Extensions have significant access to your system. Most popular extensions from verified publishers are safe, but there have been cases of malicious extensions in the marketplace. Always verify publishers, check ratings, and be cautious about what you install.
What is Workspace Trust and should I use it?
Workspace Trust is a VS Code feature that restricts certain capabilities until you explicitly trust a workspace. This prevents malicious repos from auto-executing code. Yes, you should enable it—especially when opening code from untrusted sources.
Can VS Code extensions steal my credentials?
Yes, extensions with sufficient permissions can access files, terminals, and the network. A malicious extension could read .env files, capture terminal output, or exfiltrate data. Only install extensions you trust, and audit what you have installed.
How do I audit my installed extensions?
Go to Extensions panel, review each installed extension. Check: Is the publisher verified? When was it last updated? Does it have suspicious permissions? Remove any you don't recognize or use. Consider using extension packs from trusted publishers.
Is VS Code more secure than Cursor or other editors?
VS Code has a more mature security model with Workspace Trust and extension verification. Cursor (a VS Code fork) inherits these but adds AI features that introduce their own risks. Any editor with extensions/plugins has similar trust considerations.
Last updated: January 16, 2026