IDEshd

Inspect installed VS Code extensions with local static analysis and separately generated, coverage-labelled remote evaluation evidence.

This beta is operated by the individual founder under the public label IDEshd team. Its registered identity is ideshd.ideshd; commands and settings use ideshield.*. The approved product icon is included. The source repository is private. Release status records actual per-version registry availability, exact package hashes and tested host scopes. Confirm the exact reviewed version before installing a supplied VSIX.

What it does

• Scans extension files without executing the scanned extension code. Static checks look for suspicious code patterns, dependencies, obfuscation, privileged access, and possible data exfiltration.
• Shows scan progress, retained observations, separate remote evidence, and a versioned advisory assessment in the IDEshd Security Explorer view and dashboard.
• Supports user allowlists and blocklists, individual scans, and JSON/SARIF report exports. Findings are advisory by default. Automatic finding-based enforcement requests require an explicit user/application opt-in through ideshield.policy.enforced; workspace values are ignored. Explicit user blocklists and manual actions are independent. Management requests depend on available host commands. Use the editor’s Extensions view to check and change actual state when automated management is unavailable.
• Starts scans at activation and after detected extension installs or updates by default. These triggers can be disabled in Settings.

Findings can be incomplete or incorrect. A clean scan or high score is not a guarantee of safety. Scanning does not isolate extensions that are already running. Gallery installation metadata records an installation source; it does not verify publisher identity or safety.

Install

Use Extensions → … → Install from VSIX…, select the reviewed package, and reload if prompted. Open a trusted workspace, then run IDEshd: Scan All Extensions and IDEshd: Show Security Dashboard from the Command Palette.

The release-status record identifies each exact version’s package hash, registry availability and tested host scope. Confirm that record for the package you install; source checks and prior-version receipts do not establish current-package qualification.

Historical 1.0.2 checks — October 14, 2026: the exact public package received scoped installed checks in official macOS arm64 VS Code 1.74.0 and 1.141.1, including activation, local scanning, normal cache recovery, incomplete/unscored results, signed remote evidence, three themes, settings, and native full-report/single-finding JSON/SARIF saves. Five original packages were also scanned as quarantined source data. That historical six-strategy check used static-analysis, dependency-analysis, obfuscation-detection, privilege-escalation-detection, data-exfiltration-detection and ml-analysis; production defaults used behavior-analysis instead of ml-analysis. It did not activate Python extensions or establish exhaustive parsing, harmlessness, automatic disable support or other-platform compatibility. Native API-key set/clear was not repeated. These receipts remain specific to 1.0.2; other platforms and editors remain unverified.

The package targets the desktop VS Code extension host with the official API minimum 1.74.0. It scans enabled extensions exposed to the current extension host; disabled extensions and extensions belonging to other hosts are excluded. Browser-only VS Code, remote-host coverage, virtual workspaces, other editor forks, and a combined local/remote inventory require separate validation. Node.js does not need to be installed separately to use this VSIX; Node 24 is a build-tool requirement.

Release history and local coverage

Public 1.0.1 made core default signing trust consistent with the VS Code integration, which already included the project key in public 1.0.0. It retries failed or stale remote responses and retains diagnostics; JSON/SARIF producer versions come from the installed manifest.

The published 1.0.1 local scan caps left ordinary large packages Failed / Not Scored. Public 1.0.2 repaired the whole-folder size abort while retaining bounded local coverage. Version 1.0.3 separates capability observations from supported adverse evidence and excludes the scanner from routine totals. Treat failed or incomplete coverage as unscored, and check the exact-version release status.

If you have an obsolete local ideshield.ideshield installation, disable or remove it after installing public ideshd.ideshd to avoid running both. Existing ideshield.* user-setting keys remain unchanged.

Advisory policy and migration

Since 1.0.2, ideshield.policy.enforced defaults to false and is checked at action time, including scans using cached results. Findings, severity, scores and requested policy decisions remain visible; advisory mode skips automatic finding-based management requests. To opt in, set ideshield.policy.enforced to true in user/application settings. Workspace values do not enable enforcement. Earlier public versions ignored this flag, so review any existing user value before updating.

In 1.0.3, automatic finding-based eligibility comes from the shared core assessment's qualified source evidence. A low advisory score, raw Critical/High rule impact, capability observation, or signed remote reputation alone cannot qualify an automatic block. Provenance and action-time opt-in checks remain additional guards. Explicit blocklist requests and manual actions remain independent of this flag. All management requests still require supported host commands. Historical 1.0.2 checks in official VS Code 1.74.0 and 1.141.1 did not expose the disable/enable command IDs used by this implementation. That observation does not establish command availability in other hosts or releases. Use the Extensions view to change state, follow reload prompts and verify the result; an accepted request is not proof of successful disablement. Changing this flag does not isolate an extension or prove that it has stopped running.

Assessment and scanner scope

Version 1.0.3 uses a provisional model with a finite set of supported static checks; it does not establish general detection accuracy. It separates capabilities from adverse evidence. A capability observation remains visible with zero score penalty. Details and exports retain original rule severity as Potential impact from original rule, alongside the shared model's classification, support, effective threat status, root groups and contributions. The advisory score is 0–100, not a probability or safety guarantee. A score of 100 means No scored adverse evidence in these checks. Limited static evidence remains reviewable; it does not establish malware. Unknown, incomplete, or mismatched assessment metadata is Not scored. Remote reputation and verification stay separate from the local model.

The shared assessment is bound to its model version, ordered finding set and source context. Old numerical cache scores are retained as history but are not displayed as current assessments. Ordinary rescans revalidate them without manual cache deletion or forced refresh. Existing finding IDs and user assessments are retained; grouping does not delete raw occurrences. Full JSON and SARIF reports retain the per-extension model, nullable score, coverage, groups and penalties even when there are no findings. This metadata does not fabricate a finding or alert.

The exact running scanner identity is excluded case-insensitively from routine startup/event/batch scans, pickers, inventory, alerts, policy and report denominators: IDEshd excluded: scanner itself. Other extensions with similar names remain in scope. IDEshd: Diagnostic Self-Scan explicitly scans the scanner locally into a separate ephemeral detail snapshot. It makes no remote lookup, ordinary cache/history update, routine alert or automatic management request. IDEshd: Export Diagnostic Self-Scan exports that snapshot as JSON or SARIF, clearly labelled diagnostic and excluded from the routine inventory.

Network and local data

Local static scanning reads extension manifests and files; it does not upload their contents through the remote evaluation client. Scan caches use VS Code's extension global storage, and diagnostics use the IDEshd output channel. Exported reports can contain extension identifiers, findings, paths, and evidence; review them before sharing.

Remote Insights is enabled by default. It requests existing results from https://api.ideshd.com using publisher, extension name, version, and target platform in the request URL. The service also receives normal connection metadata such as IP address. The official api.ideshd.com host is a public static result endpoint: it neither needs nor receives an API key from this client. An optional API key is stored in VS Code SecretStorage and is sent only to a user-configured authenticated HTTPS endpoint. Changing the base URL changes the recipient and its privacy/transport configuration. The client does not submit extensions or start hosted evaluations. Connection checks and refreshing remote results also make requests.

The verified default-origin configuration uses HTTPS from the client to Cloudflare and HTTP from Cloudflare to the S3 website origin in us-east-2. It does not provide end-to-end TLS to that origin. Result signature verification addresses content authenticity against configured trust anchors; it does not encrypt request metadata or prove complete coverage.

Signed v2 results are verified against configured trust anchors. Missing v2 results, including the static origin's AccessDenied response, can fall back to legacy v1 results labelled unsigned. Invalid signed results are rejected. Local results remain available when remote results are unavailable; cached remote evidence is identified separately.

For local-only scans, set this in user settings:

{
  "ideshield.remoteInsights.enabled": false,
  "ideshield.notifications.slack.enabled": false,
  "ideshield.notifications.teams.enabled": false,
  "ideshield.notifications.email.enabled": false
}

Notification integrations are disabled by default. Enabling a configured HTTPS webhook sends alert/report information to that recipient. Optional core threat-feed sources are disabled by default; this preview makes no claim that all optional integrations have been validated. Opening external links invokes the editor/browser's normal network behavior.

Settings and limits

Search Settings for ideshield. Scan triggers, scanner toggles, remote settings, and lists use the ideshield.* namespace. Keep API keys out of workspace settings and reports.

Local work remains bounded. A package-size measurement above 10 MiB produces a medium advisory and does not abort the scan. Its separate size walk excludes node_modules and hidden directories and stops at the threshold or its visit, depth and time budget; a partial threshold measurement is labelled "at least". An unfinished measurement below the threshold is reported as incomplete, rather than an exact package size.

JavaScript, TypeScript, JSX and TSX files and entry points have a default 16 MiB per-file cap; JSON and other resources retain a 2 MiB default cap. Explicit tighter limits remain effective. The code walk retains a 64 MiB main-content budget and a separate 32 MiB dependency budget, with file-count and depth limits. Per-file analysis and workers also retain time and memory limits. Files or work that cannot be covered remain explicit; actual scan errors and unparsed runtime code make the result incomplete and unscored. Expected low-level TypeScript/JSX parser notes do not by themselves assert a runtime-code failure. There is no new user setting that lifts these limits, and scan parallelism does not remove them.

Some declared settings are not enforced: ideshield.actions.*, ideshield.customRules, ideshield.trust.*, ideshield.tls.pin, ideshield.orgId, and ideshield.tenantUrl. Browser SSO sign-in, email CLI delegation, and syslog export are unavailable in this build. Do not rely on them for protection.

License and support

End-user terms in LICENSE.txt identify proprietary first-party Covered Portions and permit personal, hobby, educational, and internal business use. The Licensor is the individual rights holder operating IDEshd, reachable through the contact below. Applicable third-party copyrights and full license texts remain in THIRD_PARTY_NOTICES.txt; they are not restricted by the first-party terms. The beta is provided as-is with bounded liability and non-waivable rights preserved.

LICENSE.txt, COPYRIGHT, and THIRD_PARTY_NOTICES.txt are included in the installed extension directory and the VSIX’s extension/ directory.

Questions, feedback, and licensing: info@ideshd.com. Privacy questions, deletion requests, and security reports: abuse@ideshd.com. Read the privacy notice for service and data-handling details. Product information: ideshd.com.