How to Prevent API Key Leakage Caused by VS Code Extensions

On May 20, 2026, GitHub confirmed data theft from about 3,800 internal repositories, traced not to a server zero-day but to a rogue VS Code extension on an employee machine.

The incident shows that malicious extensions can read files with developer-level permissions, putting local secrets as well as source code at risk.

The article urges teams to stop storing API keys and secrets in code or workspaces and move them to environment variables or isolated secret management.

It also highlights the need for secret separation on dev machines, plus short-lived credentials, least privilege, and regular rotation.