Security and trust

The extension moves files with your credentials, so it keeps them where VS Code protects them, checks every server it talks to, and asks before writing from a workspace you have not trusted.

Passwords

• Passwords and key passphrases are kept in VS Code's secret storage, which the operating system's keychain protects, under sync-servers/<site>/<server>/password. They are never written to sites.json or any other file.
• They are typed into VS Code's own password box, never into the Site Settings page, which only learns whether one is saved.
• A saved password is tied to the protocol, host, port and user it was saved for. After any of them changes, it is not sent, and the password box says why when it asks again.
• A password typed in Add Site, or when a server asks, is sent only after the server's host key or certificate is verified or decided on, and saved only once the server accepts it.
• Removing a site, or a server in Site Settings, forgets its saved passwords.
• Every password that passes through is removed from the Sync Servers log.
• The command line keeps its own passwords in the operating system's credential store, so each asks once.

Servers

• SFTP host keys are shown with their fingerprint on the first connection, and pinned when you choose Trust and Remember. A different key later stops the connection and is never accepted quietly.
• FTPS certificates are checked against the system's authorities and the host name, over TLS 1.2 or later. One that does not verify is shown with its names, issuer, validity dates and SHA-256 fingerprint, and nothing more is sent until you decide: connect to a host name it covers, check it as that name, trust it by its fingerprint once or for good, or cancel. An expired certificate, or one not valid yet, is never trusted. A privately signed certificate can also be verified with its authority file in the server's Advanced settings. FTPS never falls back to plain FTP.
• Plain FTP is refused until the server's Allow plain FTP is checked, because it sends the password in clear text.
• Names a server sends that would leave the site, or that this system cannot hold, are never used as paths, and no write follows a link out of the site.

The engine's security page has the full list of threats and the test behind each defence.

Workspace trust

Sites come from your own list of sites, which a cloned repository cannot change: syncServers.configDir can be set in your user settings only. In a workspace in Restricted Mode:

• Nothing is uploaded on save.
• Synchronize, Put and Delete on Server ask before writing to a server.
• The workspace's own values for syncServers.uploadOnSave.enabled and syncServers.confirmDeletes are ignored.

The Site Settings page

The settings form runs under a Content-Security-Policy that allows its own stylesheet and one script only: no remote content, no inline code, no eval. Every message between the page and the extension is checked against a schema in both directions and dropped when it does not match, and the page reports anything its policy blocks to the log. A pinned host key or a trusted certificate can be kept or forgotten from the form. A new one is saved only when you trusted it in VS Code's own warning during a Test or Browse... from that form; the page itself can never set one.

What stays on your machine

The extension talks to your servers and to nothing else: no telemetry, no update checks, no third-party services. The list of sites, the sync records and the log stay in your user profile.

Checking a release

Each release on GitHub is built from its tag by the repository's release workflow, and carries the .vsix, a CycloneDX SBOM, a Sigstore attestation bundle and SHA256SUMS. With the files downloaded into one folder:

sha256sum --check --ignore-missing SHA256SUMS
gh attestation verify vscode-sync-servers-<version>.vsix --repo isocialPractice/vscode-sync-servers \
  --signer-workflow isocialPractice/vscode-sync-servers/.github/workflows/release.yml

Reporting a vulnerability

Report privately through the repository's private vulnerability reporting, never in a public issue. The security policy says what to include and what to expect.