VS Code has no permission model. Any extension you install runs as ordinary Node.js with the full reach of your account: your files, your SSH keys, your terminal. Nothing had to ask, so nothing prompted you.
ExtGuard audits the ones you already have, against 1,981 known-malicious records and 1,300 blocked publishers, for credentials hardcoded into shipped code, and for what each can reach.
Runs entirely on your machine. No account, no telemetry, no network calls while scanning. Free and MIT.
Run a 10-point OWASP-style security check on any page in 5 seconds. Inspects transport security, CSP, cookie flags, mixed content, exposed sensitive files, and OSV-backed library CVEs. 100% free, privacy-first, and runs locally.
Describe your niche in one sentence — Nivroo's AI builds your whole store (brand, products, copy, SEO, checkout) in 60s. It auto-sources products, prices them, fulfils orders, and answers customers. Plus a built-in stock/crypto/forex terminal. Sell on 19 channels.
