Does VSCode remote-ssh extension in remote development store ANY info client side?

Viewed 1629

This is a security oriented question. Basically I'm reviewing the appdata for vscode and I see a couple of cache files. I'm trying to figure out if any of the file data is being transferred into client OS since that would be a security violation. I don't see a firm answer on this anywhere. Microsoft saying that it's "Sandboxed" isn't good enough for my security concerns, I need to be reasonably certain.

Basically if vscode-remote is ultimately a renderer like an ssh terminal it's okay, however if it does even a small amount of plain text caching on WINDOWS that's a no no since ultimately I'd be bypassing the security of the server.

Just to be clear my access is secured over ssh and approved, but my viewing on the client side is what's in question.

It appears to be okay(haven't found any files in violation), but I need something firmer, and of course it needs to be from an official source. (or offer direct proof to substantiate the use case as secure).

1 Answers

This is not actually my own answer one of the vscode development team(Chuck Lantz) responded to a direct question by email.

Okay, have an update. We don’t currently have the equivalent of an “In-Private” mode in the browser context where all caching is in RAM.

You can, however, run VS Code in portable mode and keep the contents in a more secure location. This keeps all data relative to the application folder so you could put some or all of it in an encrypted virtual hard drive or even on a remote file share (e.g. using SSHFS).

Portable Mode in Visual Studio Code

It defaults to using the system temp location for some content, but you can change that to a sub-folder as well. The location of data folders by OS is also listed in the article.

Thanks Chuck!

Related