Dev tools · alternatives · 2026
24 alternatives to ExtGuard
Audit the VS Code extensions already running on your machine
Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes.
- 1CG
There is a growing problem with VSCode extensions: - they're not sandboxed (yet) - just like double-clicking an .exe file - they don't have a permission model - they auto update - they have built-in persistence - they are installed on developer machines with high-value credentials The recent CircleCI and LastPass incidents were both suspected to originate from a compromised developer machine - which is becoming every organization's Achilles heel in terms of cyber posture So I've been working on a way to help mitigate some of these risks Right now, only an MVP of a "CLI" is available: $ code…
2023 · its alternatives →
- 2
Hey HN, I just built an experimental VSCode extension called LLM Debugger. It’s a proof-of-concept that lets a large language model take charge of debugging. Instead of only looking at the static code, the LLM also gets to see the live runtime state—actual variable values, function calls, branch decisions, and more. The idea is to give it enough context to help diagnose issues faster and even generate synthetic data from running programs. Here’s what it does: * Active Debugging: It integrates with Node.js debug sessions to gather runtime info (like variable states and stack traces). *…
2025 · github.com · its alternatives →
- 3
Did you know that VSCode extensions run with full access to your system—including file system, network, and credentials? Worse, dozens of malicious extensions have already made it into the marketplace, silently compromising devices. I am a security researcher and student developer who ran into this problem myself. To help tackle this, I built a 100% free tool (no login required) that scans VSCode (and Cursor/Windsurf) extensions for: - Hidden malware and obfuscated code - Dangerous permissions and API misuse - Vulnerable dependencies and suspicious network connections Users have already…
2025 · vscan.dev · its alternatives →
- 4
Review your code directly in your IDE before you even merge!
2025 · marketplace.visualstudio.com · its alternatives →
- 5
NFT Guard▲236Protect yourself from fake NFTs and crypto scams
2022 · blog.mozilla.org · its alternatives →
- 6
We needed something like --dangerously-skip-permissions that doesn’t nuke your untracked files, exfiltrate your keys, or install malware. Claude Code's permission system is allow-or-deny per tool, but that doesn’t really scale. Deleting some files is fine sometimes. And git checkout is sometimes not fine. Even when you curate permissions, 200 IQ Opus can find a way around it. Maintaining a deny list is a fool's errand. nah is a PreToolUse hook that classifies every tool call by what it actually does, using a deterministic classifier that runs in milliseconds. It maps commands to action types…
Mar 2026 · github.com · its alternatives →
- 7
enject: Hide .env secrets from prAIng eyes: secrets live in local encrypted stores (per project) and are injected directly into apps at runtime, never touching disk as plaintext. - GreatScott/enject
Feb 2026 · github.com · its alternatives →
- 8
An open source security scanner for Visual Studio Code
2020 · snyk.io · its alternatives →
- 9
GitGuardian▲132Detect secrets in source code, public and private!
2018 · gitguardian.com · its alternatives →
- 10
Hi everyone, I built a runtime to isolate untrusted code using wasm sandboxes. Basically, it protects your host system from problems that untrusted code can cause. We’ve had a great discussion about sandboxing in Python lately that elaborates a bit more on the problem [1]. In TypeScript, wasm integration is even more natural thanks to the close proximity between both ecosystems. The core is built in Rust. On top of that, I use WASI 0.2 via wasmtime and the component model, along with custom SDKs that keep things as idiomatic as possible. For example, in Python we have a simple decorator:…
Feb 2026 · github.com · its alternatives →
- 11
- 12
Hi HN, I built this because I often work in coworking spaces or do screen sharing, and I've always had this fear of accidentally flashing my .env file with production secrets to the whole room (or recording). It’s a simple VS Code extension that opens .env files in a custom grid editor. It automatically masks any value longer than 6 characters so I can safely open the file to check keys without exposing the actual secrets. It runs 100% locally with zero dependencies (I know how sensitive these files are). It just reads the file, renders the grid, and saves it back as standard text. It's open…
Jan 2026 · marketplace.visualstudio.com · its alternatives →
- 13
Learn more about Snyk’s security plugins for JB, VS Code, Eclipse, and Visual Studio that provide real-time vulnerability scanning and actionable fix advice.
2020 · snyk.io · its alternatives →
- 14VC
Instantly share code snippets from VS Code with shortcut. Supports all programming languages. No sign-up, no hassle. Perfect for quick code reviews, debugging, or showing off your work.
2025 · snippetshare.dev · its alternatives →
- 15
I kept seeing every npm/pnpm/yarn/bun/uv supply chain post end with the same advice (set a minimum release age, turn off install scripts), and while I know cooldowns are "controversial", they do work. But even if you convince people that they should set cooldowns, it seems many don't end up following through, not sure why, maybe because it means hand-editing five config files in five formats with five different time units, or perhaps the "it won't happen to me" syndrome (or "I'll do it later, it seems complicated" where it's actually very simple). So I created a tool that…
Jun 2026 · github.com · its alternatives →
- 16
Hi HN, I built this because I got tired of the Claude Code CLI hiding details from me. Recent updates have replaced critical output with summaries like "Read 3 files" or "Edited 2 files". To see what actually happened, I was forced to use `--verbose`, which floods the terminal with unreadable JSON and system prompts. I wanted a middle ground: *Full observability without the noise.* `claude-devtools` is a local Electron app that tails the session logs in `~/.claude/` to reconstruct the execution trace in real-time. *Unlike wrappers, it solves the visibility gap in your native…
Feb 2026 · github.com · its alternatives →
- 17FL
Hi HN! We just launched Codacy Guardrails, an IDE extension with a CLI for code analysis and MCP server that enforces security & quality rules on AI-generated code in real-time. It hooks into AI coding assistants (like VS Code Agent Mode, Cursor, Windsurf), silently scanning and fixing AI-suggested code that has vulnerabilities or violates your coding standards, while the code it’s being generated. We built this because coding agents can be a double-edged sword. They do boost productivity, but can easily introduce insecure or non-compliant code. One recent research team at NYU found that 40%…
2025 · its alternatives →
- 18IM
Hey developers I think we're tired of copying and pasting our codes and sharing links using PasteBin, GithubGist, or Slack. What if you could share the codes without copying the link and share them right from your favorite editor? That was the motivation for creating TurboGist. Right now, it's still in the MVP stage, and I'm trying to gather feedback from developers like you. It's available as a beta in the VS Code Extension store. Can you guys check this out? It'd help me a lot. You don't need to pay any penny, 100% FREE. However, I'm working on introducing a self-hosted feature. Besides, a…
2025 · turbogist.dev · its alternatives →
- 19
devguard▲3Audit your Node.js + React project in one command
Jun 2026 · github.com · its alternatives →
- 20
Free and local code, config, dependency and security scanner
May 2026 · marketplace.visualstudio.com · its alternatives →
- 21
Hey HN, I'm Arjun, an 18-year-old intern at Socket. I've been working on a project that I'm really excited to share with you all - a browser extension that makes it easier to check the security of NPM packages before you use them. You can try the extension on any Chromium-based browser or on Firefox. Chrome extension: https://chrome.google.com/webstore/detail/socket-security/jb... Firefox add-on: https://addons.mozilla.org/en-US/firefox/addon/socket-securi... Socket scans NPM packages for malware, vulnerabilities, code smell, and…
2023 · chrome.google.com · its alternatives →
- 22
I got fed up with endless PR reviews and the constant fear of missing a security bug, so I built Shieldcode. What it does: - Scans new pull requests for bugs and vulnerabilities automatically - Comments directly on GitHub with clear, actionable feedback - Works out of the box with no complex setup required Next up: NPM VScan, which will check your npm dependencies on every push for vulnerabilities or malware. I’d love to hear your thoughts and feedback! https://shieldcode.space
2025 · shieldcode.space · its alternatives →
- 23
We made a VS Code extension [1] that lets you visualise logs and traces in the context of your code. It basically lets you recreate a debugger-like experience (with a call stack) from logs alone. This saves you from browsing logs and trying to make sense of them outside the context of your code base. We got this idea from endlessly browsing traces emitted by the tracing crate [3] in the Google Cloud Logging UI. We really wanted to see the logs in the context of the code that emitted them, rather than switching back-and-forth between logs and source code to make sense of what happened. It's a…
2025 · github.com · its alternatives →
- 24
A VSCode extension for running accessibility audits using be-a11y - be-lenka/vscode-be-a11y
2025 · github.com · its alternatives →
Also compare
Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →