extension-security

What problem does it solve?

This Skill ensures that VS Code extensions are developed and published securely, preventing the accidental inclusion of sensitive credentials and protecting users from potential vulnerabilities.

Core Features & Use Cases

• Credential Management: Enforces the use of VS Code's SecretStorage for all API keys and sensitive data, preventing hardcoding.
• Publishing Verification: Utilizes vsce ls to verify that no sensitive files or source code are included in the final extension package (.vsix).
• Secret Scanning: Integrates a scanner to detect common patterns of secrets within code.
• Use Case: Before publishing a new VS Code extension that requires an API key, use this Skill to audit your code, verify your .vscodeignore file, and run vsce ls to ensure no secrets are exposed.

Quick Start

Run the security audit for the 'my-extension' VS Code extension.