security-best-practices

To audit VS Code extension code for security vulnerabilities, run the audit.sh script against your codebase. This checks API key handling, secure storage, logging practices, and WebView CSP to prevent secret leaks and XSS risks.

Content-Security-Policy (CSP) in VS Code WebViews is a security layer that mitigates XSS attacks. Proper CSP usage restricts resource loading and script execution, ensuring malicious code cannot run inside the extension environment.

Securely store API keys in a VS Code extension by using the provided secret storage mechanisms rather than hardcoding or logging them. The audit verifies that keys are protected and safe error messages are used.

Yes, this security audit checks fetch calls and filesystem access within VS Code extensions. It enforces safeguards to ensure these operations follow best practices and do not introduce vulnerabilities.

Yes, you can use this audit script for LuxCode AI API usage and secret handling. It specifically validates code against best practices for IA API calls, preventing API key leaks and improper logging.