Protecting API Keys from a Malicious VS Code Extension

GitHub confirmed attackers used a malicious or compromised VS Code extension on one employee laptop to access data from about 3,800 internal repositories.

The breach was workstation-based, not a server-side zero-day, showing that local developer tools can be a major attack surface.

The incident underscores the need to keep API keys and other secrets out of project files, including hardcoded values and committed .env files.

Teams should isolate, rotate, and centrally manage secrets to reduce supply-chain and workstation risk.