# Risk map — microsoft/vscode

> Canonical page: https://codevetter.com/unpack/vscode/risk-map

# Risk map — microsoft/vscode

Scanned commit f6439326f6891a1eaf254a19fc1a78243cbb8f9d (2026-09-22). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

The largest blast radius is the IPC/channel surface: renderer and shared-process clients reach privileged main-process services over ~30 channels, so any renderer compromise (webview, extension UI) inherits capabilities like file IO, pty spawn, storage, and native host calls — mitigated by validatedIpcMain and sandboxing, but the surface is huge. Secrets have a deliberate weak fallback (plaintext encryption) and an in-memory storage flag. The main process performs privileged file writes (argv.json auto-creation, lockfiles) and spawns shells/extensions/agent processes. Remote debugging and proposed-API flags in argv.json lower security postures when enabled. Untested or thinly-tested areas include much of electron-main orchestration and many UI contribs.
- Renderer→main IPC is a broad privilege boundary: channels registered in initChannels include 'storage', 'nativeHost', 'localPty', 'webview', 'externalTerminal', 'extensionHostStarter' and LOCAL_FILE_SYSTEM_CHANNEL_NAME — validatedIpcMain exists to vet senders, so new channels must use it or they bypass sender validation. — [src/vs/code/electron-main/app.ts#L1336-L1490](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/code/electron-main/app.ts#L1336-L1490) [src/vs/base/parts/ipc/electron-main/ipcMain.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/base/parts/ipc/electron-main/ipcMain.ts)
- Secret storage can silently degrade: when no OS keyring is found, the user is offered 'Use weaker encryption' (plaintext) via secretStorageService, and argv.json's use-inmemory-secretstorage drops persistence entirely. — [src/vs/workbench/services/secrets/electron-browser/secretStorageService.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/workbench/services/secrets/electron-browser/secretStorageService.ts) [src/main.ts#L286-L291](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/main.ts#L286-L291)
- The extension host executes arbitrary third-party extension code with Node.js capabilities; proposed APIs are gated by ExtensionsProposedApi and --enable-proposed-api in argv.json is a documented escape that can enable unstable surface globally or per-extension. — [src/vs/workbench/api/common/extHostExtensionService.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/workbench/api/common/extHostExtensionService.ts) [src/main.ts#L280-L281](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/main.ts#L280-L281) [src/vs/workbench/services/extensions/common/extensionsProposedApi.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/workbench/services/extensions/common/extensionsProposedApi.ts)
- Shell-out surface: PtyService/terminalProcess spawn arbitrary shells from user settings, externalTerminalService launches OS terminals, and the main process exposes 'externalTerminal' and localPty channels; task runners (contrib/tasks) execute workspace-defined commands — a classic workspace-trust risk mitigated by IWorkspaceTrustManagementService. — [src/vs/platform/terminal/node/terminalProcess.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/platform/terminal/node/terminalProcess.ts) [src/vs/platform/externalTerminal/node/externalTerminalService.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/platform/externalTerminal/node/externalTerminalService.ts) [src/vs/platform/workspace/common/workspaceTrust.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/platform/workspace/common/workspaceTrust.ts) [src/vs/workbench/browser/web.main.ts#L60-L61](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/workbench/browser/web.main.ts#L60-L61)
- argv.json is auto-created with comments and supports remote-debugging-port, js-flags, and enable-proposed-api — powerful persisted flags an attacker or misconfiguration could abuse; the file is parsed synchronously before app ready. — [src/main.ts#L251-L291](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/main.ts#L251-L291) [src/main.ts#L417-L470](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/main.ts#L417-L470)
- Privileged custom schemes vscode-webview/vscode-file/vscode-remote-resource are registered with fetch/CORS/service-worker privileges before app ready; webview content is additionally isolated to a CDN base template in product.json (webviewContentExternalBaseUrlTemplate). — [src/main.ts#L111-L128](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/main.ts#L111-L128) [product.json#L39](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/product.json#L39) [src/vs/platform/webview/electron-main/webviewMainService.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/platform/webview/electron-main/webviewMainService.ts)
- Windows UNC paths are selectively allow-listed via addUNCHostToAllowlist for user-data and extension paths — a security-sensitive gate that would be easy to weaken accidentally in environment/path handling code. — [src/vs/code/electron-main/main.ts#L337-L346](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/code/electron-main/main.ts#L337-L346) [src/main.ts#L61-L66](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/main.ts#L61-L66)
- Telemetry collects PII-adjacent identifiers: resolveMachineId/resolveSqmId/resolveDevDeviceId plus getPiiPathsFromEnvironment and a large OSProxyConfig telemetry event enumerating proxy configuration states — all routed through shared-process appenders and controlled by TelemetryLevel. — [src/vs/code/electron-main/app.ts#L156-L198, ](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/code/electron-main/app.ts#L156-L198, ) [src/vs/platform/telemetry/electron-main/telemetryUtils.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/platform/telemetry/electron-main/telemetryUtils.ts)
- Import-barrel coupling is fragile: workbench.*.main.ts ordering determines singleton registration and contrib loading; the banner comment in workbench.web.main.ts and the 'do NOT register services here' note in workbench.ts indicate this has bitten contributors before. — [src/vs/workbench/workbench.web.main.ts#L7-L11](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/workbench/workbench.web.main.ts#L7-L11) [src/vs/workbench/browser/workbench.ts#L177-L180](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/workbench/browser/workbench.ts#L177-L180)
- Single-instance lock + lockfile handling (claimInstance, mainLockfile unlink on shutdown) is a known-fragile area: onWillShutdown joins async lockfile deletion, and the Inno Setup mutex check can release the IPC server mid-startup — race-prone code with historically linked GitHub issues. — [src/vs/code/electron-main/main.ts#L140-L154](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/code/electron-main/main.ts#L140-L154) [src/vs/code/electron-main/main.ts#L359-L366](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/code/electron-main/main.ts#L359-L366)
- Agent host processes (ElectronAgentHostStarter/AgentHostProcessManager, platform/agentHost) spawn utility processes that talk to external AI services; combined with AgentNetworkFilterService and MCP gateway, this is a new, fast-moving attack surface with sparse test coverage (inference). (inferred) — [src/vs/code/electron-main/app.ts#L756-L766](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/code/electron-main/app.ts#L756-L766) [src/vs/platform/agentHost/node/agentHostService.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/platform/agentHost/node/agentHostService.ts) [src/vs/platform/networkFilter/common/networkFilterService.ts](https://github.com/microsoft/vscode/blob/f6439326f6891a1eaf254a19fc1a78243cbb8f9d/src/vs/platform/networkFilter/common/networkFilterService.ts)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)