> Markdown version of [/videos/717-you-click-you-lose-a-practical-look-at-vscode-s-security?t=1607](https://www.wearedevelopers.com/videos/717-you-click-you-lose-a-practical-look-at-vscode-s-security?t=1607). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# You click, you lose: a practical look at VSCode's security

Think opening a workspace in VS Code is safe? Attackers can exploit its web-based architecture to execute arbitrary code the moment you click a malicious repository link.

- **Speakers:** Thomas Chauchefoin, Paul Gerste
- **Event:** World Congress 2023
- **Published:** September 27, 2023
- **Duration:** 29:47
- **URL:** https://www.wearedevelopers.com/videos/717-you-click-you-lose-a-practical-look-at-vscode-s-security
- **Thumbnail URL:** https://customer-goifxnzhrq3d0d54.cloudflarestream.com/e14932b77fd873514fe260458b40cfb6/thumbnails/thumbnail.jpg?time=299480ms

## Access

Playback and chapters for this video are available with a Free account.

## Related Moments

- [Risks of malicious VS Code extensions and AI assistants](https://www.wearedevelopers.com/videos/1794-wearedevelopers-live-from-javascript-to-webassembly-high-performance-charting-and-more) (from "WeAreDevelopers LIVE – From JavaScript to WebAssembly, High-Performance Charting and More")
  - **Thumbnail URL:** https://customer-goifxnzhrq3d0d54.cloudflarestream.com/0fe863e6b4afc957d92d3527a5932da2/thumbnails/thumbnail.jpg?time=346355ms
- [Visual Studio Code as a target for exploitation](https://www.wearedevelopers.com/videos/283-vulnerable-vs-code-extensions-are-now-at-your-front-door) (from "Vulnerable VS Code extensions are now at your front door")
  - **Thumbnail URL:** https://customer-goifxnzhrq3d0d54.cloudflarestream.com/229ffbd195e7270bbbfc9cccc1676c1d/thumbnails/thumbnail.jpg?time=48695ms
- [Identifying security risks in developer IDE environments](https://www.wearedevelopers.com/videos/468-securing-your-application-software-supply-chain) (from "Securing your application software supply-chain")
  - **Thumbnail URL:** https://customer-goifxnzhrq3d0d54.cloudflarestream.com/cad82c8e5ef1cef7c00dc1c876a143f3/thumbnails/thumbnail.jpg?time=244300ms
- [Addressing remote code execution vulnerabilities in text editors](https://www.wearedevelopers.com/videos/1803-wearedevelopers-live-keeping-up-with-styles-data-more) (from "WeAreDevelopers LIVE – Keeping Up with Styles, Data & More")
  - **Thumbnail URL:** https://customer-goifxnzhrq3d0d54.cloudflarestream.com/c206b0c4bdfb6d0a92199117d6891429/thumbnails/thumbnail.jpg?time=577515ms
- [Exploiting path traversal vulnerabilities in code editor extensions](https://www.wearedevelopers.com/videos/716-hack-proof-the-node-js-runtime-the-mechanics-and-defense-of-path-traversal-attacks) (from "Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks")
  - **Thumbnail URL:** https://customer-goifxnzhrq3d0d54.cloudflarestream.com/127bcd3cc3112fdca38f0d8e3b649ab5/thumbnails/thumbnail.jpg?time=204050ms
- [Mitigating extension vulnerabilities and applying workspace trust](https://www.wearedevelopers.com/videos/283-vulnerable-vs-code-extensions-are-now-at-your-front-door) (from "Vulnerable VS Code extensions are now at your front door")
  - **Thumbnail URL:** https://customer-goifxnzhrq3d0d54.cloudflarestream.com/229ffbd195e7270bbbfc9cccc1676c1d/thumbnails/thumbnail.jpg?time=48695ms

## Related Articles

- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [Dev Digest 176: Expensive Agents, Taking Over VSCode and Safer Vibe Coding](https://www.wearedevelopers.com/magazine/603-dev-digest-176-expensive-agents-taking-over-vscode-and-safer-vibe-coding)
- [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)
- [Dev Digest 131 - AI'm not sure about OSS](https://www.wearedevelopers.com/magazine/472-dev-digest-131-ai-m-not-sure-about-oss)

## Related Jobs

- [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/2628442-staff-developer-advocate-github-security-lab) at **GitHub**
- [Senior Software Engineer, Vulnerability Management](https://www.wearedevelopers.com/jobs/ext/3814641-senior-software-engineer-vulnerability-management) at **GitHub**
- [Senior Software Engineer, Sandboxes (Eu Or East Coast Preferred)](https://www.wearedevelopers.com/jobs/ext/2145616-senior-software-engineer-sandboxes-eu-or-east-coast-preferred) at **Docker, Inc.**
- [SoC Offensive Security Staff Engineer](https://www.wearedevelopers.com/jobs/48479-soc-offensive-security-staff-engineer) at **Arm**
- [Senior Software Engineer, Sandboxes (Eu Or East Coast Preferred)](https://www.wearedevelopers.com/jobs/ext/2159298-senior-software-engineer-sandboxes-eu-or-east-coast-preferred) at **Docker, Inc.**
- [Senior Software Engineer, Sandboxes (Eu Or East Coast Preferred)](https://www.wearedevelopers.com/jobs/ext/2145730-senior-software-engineer-sandboxes-eu-or-east-coast-preferred) at **Docker, Inc.**