ExtGuard
Audit the VS Code extensions already running on your machine
ExtGuard launched on August 25, 2026 with 1 votes, #11,494 of 23,274 launches that month.
What it does
VS Code has no permission model. Any extension you install runs as ordinary Node.js with the full reach of your account: your files, your SSH keys, your terminal. Nothing had to ask, so nothing prompted you. ExtGuard audits the ones you already have, against 1,981 known-malicious records and 1,300 blocked publishers, for credentials hardcoded into shipped code, and for what each can reach. Runs entirely on your machine. No account, no telemetry, no network calls while scanning. Free and MIT.
ExtGuard audits installed VS Code extensions for leaked secrets, risky capabilities, and known malicious IDs.
Does a similar job
all alternatives →- CGCoder Guard – Protect Your IDE from Malicious Extensions2023 · ▲10
There is a growing problem with VSCode extensions: - they're not sandboxed (yet) - just like double-clicking an .exe file - they don't have a permission model - they auto update - they have built-in persistence - they are installed on developer machines with high-value credentials The recent CircleCI and LastPass incidents were both suspected to originate from a compromised developer machine - which is becoming every organization's Achilles heel in terms of cyber posture So I've been working on a way to help mitigate some of these risks Right now, only an MVP of a "CLI" is available: $ code…
Letting LLMs Run a Debugger2025 · github.com · ▲147Hey HN, I just built an experimental VSCode extension called LLM Debugger. It’s a proof-of-concept that lets a large language model take charge of debugging. Instead of only looking at the static code, the LLM also gets to see the live runtime state—actual variable values, function calls, branch decisions, and more. The idea is to give it enough context to help diagnose issues faster and even generate synthetic data from running programs. Here’s what it does: * Active Debugging: It integrates with Node.js debug sessions to gather runtime info (like variable states and stack traces). *…
VSCan - Detect Malicious VSCode Extensions2025 · vscan.dev · ▲52Did you know that VSCode extensions run with full access to your system—including file system, network, and credentials? Worse, dozens of malicious extensions have already made it into the marketplace, silently compromising devices. I am a security researcher and student developer who ran into this problem myself. To help tackle this, I built a 100% free tool (no login required) that scans VSCode (and Cursor/Windsurf) extensions for: - Hidden malware and obfuscated code - Dangerous permissions and API misuse - Vulnerable dependencies and suspicious network connections Users have already…
A context-aware permission guard for Claude CodeMar 2026 · github.com · ▲127We needed something like --dangerously-skip-permissions that doesn’t nuke your untracked files, exfiltrate your keys, or install malware. Claude Code's permission system is allow-or-deny per tool, but that doesn’t really scale. Deleting some files is fine sometimes. And git checkout is sometimes not fine. Even when you curate permissions, 200 IQ Opus can find a way around it. Maintaining a deny list is a fool's errand. nah is a PreToolUse hook that classifies every tool call by what it actually does, using a deterministic classifier that runs in milliseconds. It maps commands to action types…
Sandboxing untrusted code using WebAssemblyFeb 2026 · github.com · ▲76Hi everyone, I built a runtime to isolate untrusted code using wasm sandboxes. Basically, it protects your host system from problems that untrusted code can cause. We’ve had a great discussion about sandboxing in Python lately that elaborates a bit more on the problem [1]. In TypeScript, wasm integration is even more natural thanks to the close proximity between both ecosystems. The core is built in Rust. On top of that, I use WASI 0.2 via wasmtime and the component model, along with custom SDKs that keep things as idiomatic as possible. For example, in Python we have a simple decorator:…
Dotenv Mask Editor: No more embarrassing screen leaks of your .envJan 2026 · marketplace.visualstudio.com · ▲28Hi HN, I built this because I often work in coworking spaces or do screen sharing, and I've always had this fear of accidentally flashing my .env file with production secrets to the whole room (or recording). It’s a simple VS Code extension that opens .env files in a custom grid editor. It automatically masks any value longer than 6 characters so I can safely open the file to check keys without exposing the actual secrets. It runs 100% locally with zero dependencies (I know how sensitive these files are). It just reads the file, renders the grid, and saves it back as standard text. It's open…
More dev tools this month
the category →
open-source IDE for thoughtful software design. Contribute to devdotfast/whiteboard development by creating an account on GitHub.
Dev tools · 29d ago · github.com
Contribute to reladraw/reladraw development by creating an account on GitHub.
Dev tools · 27d ago · github.com
Contribute to oosexgang/hackios-xnu-kernel development by creating an account on GitHub.
Dev tools · 16h ago · github.com
OpenBot▲362Grok Bot alternative: free, local, open-source, multiplayer
Dev tools · 24d ago · openbot.run
Talanoa▲346Hi HN, I’m a fullstack developer, and honestly, I’ve lost count of how many side projects I’ve worked on over the years. But one idea kept coming back to me: a different kind of email client. It first came to me in 2014: “What if we could handle emails more like conversations?” Every year, I’d revisit this concept in my “Build Notes.” Ten years later, no one had built exactly what I had in mind — so I finally decided to do it myself. That’s how Talanoa was born. I wanted something focused on people, not timelines. I was tired of marking messages as unread just to remember to reply later, or…
Dev tools · 21d ago · talanoa.email
Source: Product Hunt launch ↗
Launched alongside, August 2026
the whole month →- TL
Life & fun · Aug 2026 · louisabraham.github.io
Clipto MCP▲655Hey HN, We recently built Clipto. It’s a tool that lets you search over terabytes of video, audio, and images on your computer, without relying on the cloud. Motivation: we probably all had this similar experience, we know a moment exists in a video or audio, but finding it takes hours scrubbing the timeline. You can send all the media to process in the cloud, but it’s slow, expensive and raises privacy concerns. So we decided to build our own on-device media search engine. How it works (high level): 1. We ingest video, audio, image; normalize formats via ffmpeg; run content analysis to…
Work · Aug 2026 · clipto.com
Hello HN! I found that picking out plausible but diverse skin tones for my digital art and game development projects was kind of difficult, and I got curious about if there was a way to define a color space that made it easy. I've built a color picker and procedural generation algorithm based on the space as well as a bunch of other fun js features and demos throughout the page that use the equations. If you find it interesting, I have lots of explanations of how I built it and what properties the space has. The methodology might be a bit shaky, but hopefully the result is as helpful for…
Life & fun · Aug 2026 · toneyalexander.github.io
Astute▲606Automate your B2B brand going viral, with new media creators
AI · Aug 2026 · company-app.joinastute.com