Security

How the extension is built

The security posture follows from one decision: there is no server. Nothing to breach, no credentials to leak, no database of anyone's prompts.

• Local by default. Chat history is read from the storage VS Code already keeps on your disk. Derived results are cached in the extension's own storage on the same machine.
• No network of our own. The extension makes no HTTP requests. The only outbound traffic is the language-model call VS Code makes on your behalf, through your own Copilot entitlement.
• No secrets. There is no API key, no token and no account, so there is nothing to store or exfiltrate. The repository is scanned on every commit to keep it that way.
• Sandboxed UI. The interface is a VS Code webview with a strict content security policy. Scripts are limited to the bundled code, and the webview cannot reach the file system directly.
• No remote code. Everything ships inside the extension package. Nothing is fetched, evaluated or updated at runtime.
• Auditable. The extension is MIT licensed and the full source, including the exact code in every release, is public on GitHub.

Things worth knowing

An honest security page names the sharp edges rather than only the good parts.

• Your prompt history is sensitive. It can contain code, internal paths, hostnames and anything you once pasted into a chat window. The extension does not redact it, and neither do exports.
• Features that call a model send prompt text to that model. Filtering to one project before generating keeps the scope of a request tight.
• Generated prompts and instruction files are derived from real chats. Review them before committing them to a shared repository.
• Your history is stored unencrypted by VS Code itself. Anyone with access to your user account can read it with or without this extension; disk encryption is the right control for that.

This website

prompts.deb0.com is static HTML served over HTTPS from GitHub Pages, with HTTPS enforced. It has no cookies, no analytics, no third-party requests and no user input of any kind. The single script on each page reads and writes one colour-theme value in your browser's own storage.

Reporting a vulnerability

Please report privately first, and give me a chance to ship a fix before any public disclosure.

1. Open a private security advisory on the repository. This is the fastest route and keeps the report confidential until a fix is out.
2. Include the version, the platform, what an attacker gains, and the smallest set of steps that reproduces it.
3. Please do not open a public issue, post a proof of concept, or test against anyone else's machine or data.

This is a personal project maintained in spare time, so there is no paid bounty and no guaranteed response window — but reports are read and taken seriously, valid ones are fixed and released promptly, and credit is given in the advisory unless you would rather stay anonymous.

Supported versions

Fixes land on the latest release. The extension auto-updates through the Marketplace, so staying current is the whole of the patch policy. Earlier versions are not backported.