Protecting API Keys: Staying Safe from Malicious VS Code Extensions

GitHub said a malicious VS Code extension on an employee laptop helped steal data from about 3,800 internal repositories.

The report highlights how hardcoded secrets and committed .env files can be exposed to local tools on developer machines.

The breach shows API security must cover endpoints, editors, and other developer tools—not just cloud systems.

Best practices include keeping secrets out of code, using .gitignore, rotating keys, and enforcing least privilege.