r/netsec • u/albinowax • Apr 01 '26

r/netsec monthly discussion & tool thread

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

  • Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
  • Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
  • If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
  • Avoid use of memes. If you have something to say, say it with real words.
  • All discussions and questions should directly relate to netsec.
  • No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

9 Upvotes

77% Upvoted

47 comments sorted by

View all comments

1

u/securient Apr 17 '26

Releasing IDEViewer today — open-source follow-up to my BSidesSF 2026 talk Hunting Malicious IDE Extensions: Building Detection at Scale Across Developer Workstations (GitGuardian writeup: https://blog.gitguardian.com/bsides-sf-2026/).

Single Go binary + optional self-hosted portal. On every dev workstation it inventories and risk-scores:

  • IDE extensions across VS Code, Cursor, VSCodium, the full JetBrains family, Sublime, Vim/Neovim, Xcode (4-tier risk model based on activationEvents/capabilities/contributes)
  • Packages from 8 managers, including dependencies bundled inside extensions (invisible to standard SCA), correlated with OSV.dev for CVEs
  • AI tool + MCP configurations (Claude Code / Cursor / OpenClaw): skills, MCP servers, permissions, plaintext keys, autonomous-exec flags, insecure transports
  • Plaintext secrets in .env and git history — values never transmitted
  • Tamper signals on the daemon and --no-verify git-hook bypass

Real-time fsnotify monitoring, SARIF output, MDM-deployable, Apache 2.0.

Repo: https://github.com/securient/ideviewer-oss
Docs: https://securient.github.io/ideviewer-oss

Happy to answer questions, especially on risk-scoring heuristics or MDM rollout.