Coder Guard – Protect Your IDE from Malicious Extensions
There is a growing problem with VSCode extensions: - they're not sandboxed (yet) - just like double-clicking an .exe file - they don't have a permission model - they auto update - they have built-in persistence - they are installed on developer machines with high-value credentials The recent CircleCI and LastPass incidents were both suspected to originate from a compromised developer machine - which is becoming every organization's Achilles heel in terms of cyber posture So I've been working on a way to help mitigate some of these risks Right now, only an MVP of a "CLI" is available: $ code…
In plain words
Coder Guard is a security tool that scans VSCode extensions to identify potential risks from malicious or compromised add-ons. It addresses the vulnerability of unsandboxed extensions installed on developer machines that contain high-value credentials. Currently available as a CLI tool, it analyzes installed extensions and provides threat intelligence to help organizations assess extension trustworthiness and reduce the risk of compromised developer environments.
written from the facts on this page · September 2026
From the sources
In the maker’s words, at launch
There is a growing problem with VSCode extensions: - they're not sandboxed (yet) - just like double-clicking an .exe file - they don't have a permission model - they auto update - they have built-in persistence - they are installed on developer machines with high-value credentials The recent CircleCI and LastPass incidents were both suspected to originate from a compromised developer machine - which is becoming every organization's Achilles heel in terms of cyber posture So I've been working on a way to help mitigate some of these risks Right now, only an MVP of a "CLI" is available: $ code --list-extensions --show-versions | curl --data-binary @- https://coderguard.io/scan Which will list your installed extensions with some enriched information to vet their trustfulness But much more detailed threat intel will be shown in the upcoming website and extension, including - Behavioural data gathered from running the extension on an instrumented sandbox environment - The ability to define policies to allow or block extension installs/updates, based on your specific risk appetite For updates, sign up at https://coderguard.io or follow https://twitter.com/coderguard The reason I'm posting this now is because I'd like to get some feedback in order to course-correct to make sure what I build actually solves people's problems I'd be happy to read any comments, or answer any questions
More dev tools this month
the category →
Open-source GTM skills for technical founders
Dev tools · 29d ago · gtmcofounder.com
OpenTrailPaper is open-source bike computer firmware for the LilyGO T5S3 4.7" E-Paper PRO. It supports offline maps, GPX routes, FIT recording and Bluetooth sensors.
Dev tools · 1d ago · opentrailpaper.com
Launched alongside, January 2023
the whole month →- NA
This works suprisingly well. Just give it instructions like "make it winter" or "remove the cars" and the photo is altered. Here are some examples of transformations it can make: Golden gate bridge: https://raw.githubusercontent.com/brycedrennan/imaginAIry/ma... Girl with a pearl earring: https://raw.githubusercontent.com/brycedrennan/imaginAIry/ma... I integrated this new InstructPix2Pix model into imaginAIry (python library) so it's easy to use for python developers.
AI · 2023 · github.com
HyperSwitch▲715Fast, reliable, and affordable open source payments switch
Dev tools · 2023 · hyperswitch.io
- IV
The project is called QueryStorm. It uses Roslyn to offer C# (and VB.NET) support in Excel, as an alternative to VBA. I've posted about it before, but a lot has changed since then so figured I'd share an update. The current version includes a host of new features, namely a C# debugger, support for NuGet packages, and the ability to publish Excel extensions to an "AppStore" (which is essentially a NuGet repository). The AppStore can be used by anyone with the (free) runtime component. Another great addition is the community license, which is a free license for individuals and small companies…
Work · 2023 · querystorm.com
- IM
Hey HN! Some more info: I’m an NHS doctor and the founder of Pi-A (https://www.pi-a.io) which developed Lungy (https://www.lungy.app). Lungy is an app (iOS only for now) that responds to breathing in real-time and was designed to make breathing exercises more engaging and beneficial to do. It hopefully has many aspects of interest to the HN community – real-time fluid, cloth and soft body sims running on the phone’s GPU. My background is as a junior surgical trainee and I started building Lungy in 2020 during the first COVID lockdown in London. During COVID, there were…
Life & fun · 2023 · lungy.app
