GuardRails

Inspiration

I was looking for IDE extensions for different things I was building and realized how little I actually knew about them before installing them.

An extension can have access to your files, workspace, network, and other parts of your development environment. But when you click Install, most of the time you're mainly looking at the name, description, ratings, and number of users.

I wanted to know what was actually changing inside an extension and whether there were things I should be aware of before giving it access to my environment.

That is where GuardRails started.

What we built

GuardRails is a security tool for IDE extensions.

You can use it to look at an extension, inspect its security-related information, and compare different releases to see what changed.

The idea isn't to simply label an extension as "safe" or "unsafe". The goal is to give developers enough information to make their own decision before installing or updating an extension.

How we built it

We built the project as a web application that collects and analyzes information about IDE extensions and their releases.

The interface brings that information together so that instead of manually downloading an extension, looking through its files, checking its permissions, and comparing releases yourself, you can investigate it from one place.

We also built an extension registry to make it easier to find and research extensions.

What we learned

The biggest thing we learned was that extension security is not as simple as checking for one vulnerability or one permission.

Some extensions genuinely need access to files, the network, or the workspace to do their job. What matters is understanding the context and noticing things that deserve a closer look.

We also realized that there is a gap between security analysis and what a normal developer actually wants to know. Developers don't necessarily want a huge security report. They want to know "Should I install this, and why?"

Challenges

One of the hardest parts was figuring out what information is actually useful when judging an extension.

Another challenge was comparing releases in a meaningful way. An extension changing between versions isn't automatically suspicious, so the system needs to help identify changes that are worth investigating rather than treating every change as a problem.

There was also a lot of work involved in making the results understandable instead of just displaying raw technical information.

What's next

There is still a lot we want to add to GuardRails.

We want to improve the analysis, make release comparisons more useful, expand the extension registry, and make it easier to check an extension while you're actually looking for one.

The goal is straightforward:

Check the extension before you click Install.