Distribution Security

Rule: Each layer must work independently. A failure in Layer 1 should not cascade — Layer 2 still blocks unauthorized actions, Layer 3 still catches leaked keys, Layer 4 still records the attempt.

PII Protection

3-Layer Exclusion Model

For projects that package and distribute source files:

Personal Data Rules

Rationale: Users installing software see package.json and source headers. Personal names create trust concerns and privacy issues.

Secrets Scanning

Detection Patterns

False Positive Reduction

Naive regex scanning floods developers with noise. Filter these contexts:

Rule: Only alert on literal string values that match secret patterns outside of comments, imports, and environment variable references.

Priority Matrix for Findings

When security audits surface findings, triage with this matrix:

Permission Minimization

The Less-Is-More Principle

Request ONLY the permissions your software actually uses:

Rule: Users evaluate trust based on the scariest permission requested. One unnecessary permission can tank adoption.

Permission Audit Checklist

For every capability that requires a permission:

1. Is this the minimum scope that enables the feature?
2. Can this be a delegated permission (user context) instead of application?
3. Can this be requested just-in-time instead of at install?
4. Does the permission description match what users expect?
5. Can we function without this permission (graceful degradation)?

Content Security Policy (CSP)

Secure UI Patterns

For WebViews, panels, and embedded web content:

Data-Cmd Pattern

Replace inline event handlers with data attributes:

<!-- Anti-pattern: inline handler (blocked by CSP) -->
<button onclick="doThing()">Click</button>

<!-- Secure: data-cmd + delegated listener -->
<button data-cmd="do-thing">Click</button>

<script>
  document.addEventListener('click', (e) => {
    const cmd = e.target.closest('[data-cmd]')?.dataset.cmd;
    if (cmd) handleCommand(cmd);
  });
</script>

WebView Security

Communication Pattern

WebViews run in sandboxed iframes. Communication must use message passing:

Critical: window.open() silently fails in WebViews. Links that need to open externally must send a message to the extension, which calls vscode.env.openExternal().

Message Validation

Always validate messages on both sides:

// Extension side - validate WebView messages
panel.webview.onDidReceiveMessage((msg) => {
  if (!msg.type || typeof msg.type !== 'string') return;
  switch (msg.type) {
    case 'save': handleSave(msg.data); break;
    case 'navigate': handleNavigate(msg.url); break;
    // Ignore unknown message types
  }
});

Kill Switch Pattern

Multi-Layer Protection for Destructive Operations

For operations that could cause irreversible damage:

Rule: The confirmation dialog ("I Understand" button) must STILL block the destructive action even if earlier layers fail. Each layer is independent.

Security Testing

Test Priority Order

When adding test coverage to security-critical code:

Rule: Achieve 80%+ coverage on Tier 1 before touching Tier 4. In a resource-constrained sprint, security tests win over UI tests every time.

SFI Compliance (Azure/Microsoft)

Audit Scope

Security audits must scan the full subscription, not just infrastructure-as-code:

Rule: Always combine IaC scanning with live subscription scanning. Manual portal clicks create resources that IaC scans will never find.