Policy-based management of Visual Studio Code (VSCode) extensions

[kc9wwh]

• Unpacked: TODO: Head of Product Design (HPD) checks this box when the request goes through "Unpacking the why": https://fleetdm.com/handbook/product-design#unpacking-the-why
• customer-knopfia: Gong snippet

---

The Problem

There is currently no way to manage Visual Studio Code (VSCode) extensions within our environment. We need a way to approve and restrict which extensions our developers can install to ensure security, privacy, and compliance with our legal standards. Without this, we risk exposure to malicious extensions or extensions that do not meet our company's requirements.

What have you tried?

We currently have a manual process for approving Chrome browser extensions, which involves a review by our security, privacy, and legal teams. We would like to implement a similar process for VSCode extensions. We have considered creating a manual list of approved extension IDs, but this is not a scalable or enforceable solution.

Potential solutions

We propose the ability to create and enforce an "allow list" for VSCode extensions. This would allow us to pre-approve a list of extensions that are available for developers to install. Any extension not on the allow list would be blocked from installation. We would also be open to the possibility of a "block list" or a combination of both.

What is the expected workflow as a result of your proposal?

1. An administrator creates and maintains an allow list of approved VSCode extensions within Fleet.
2. A developer attempts to install a VSCode extension.
3. If the extension is on the allow list, the installation is successful.
4. If the extension is not on the allow list, the installation is blocked, and the developer is notified that the extension is not approved by company policy.
5. Developers can view the list of approved extensions available to them.