Show HN: IDEViewer – Security scanner for malicious IDE Extensions (github.com)

Securient has launched IDEViewer, a groundbreaking cross-platform security scanner aimed at enhancing developer workstation safety by identifying supply chain threats. This tool specializes in detecting risky IDE extensions, vulnerable dependencies, plaintext secrets, and insecure AI tool configurations. Built as a single Go binary, IDEViewer runs comprehensive scans across over seven popular IDEs and integrates an optional self-hosted dashboard for real-time monitoring and team visibility. The significance of IDEViewer for the AI/ML community lies in its focus on the unique risks posed by IDE extensions that operate with extensive permissions, potentially exposing developers to attacks. It employs a four-tier risk model to evaluate extension permissions and detects various AI tools, flagging configurations that could lead to security breaches. The tool also provides features like secrets detection without transmitting sensitive values, CVE correlation for known vulnerabilities, and real-time monitoring of extension changes. By offering developers a robust framework for identifying risks proactively, IDEViewer aims to fortify the often-overlooked attack surface of developer environments amid the growing integration of AI tools in software development.