AI SECURITYLABS

Security for Copilot Development: Lock down VS Code

Part 9 of 16

Lock down VS Code

A few user settings close most of the gaps (VS Code docs):

  • chat.tools.global.autoApprove: false: VS Code describes enabling it as a setting that “disables critical security protections”.
  • chat.permissions.default: "default": new sessions start with Default Permissions; choose Bypass Approvals or Autopilot per session only.
  • A read-only terminal auto-approve list: VS Code calls it “a best-effort convenience, not a security boundary”, so never add shells, deletes, network tools or /.*/.
  • chat.agent.sandbox.enabled: "on" with allowNetwork: false: approved commands run in an OS sandbox on macOS, Linux and WSL2, reaching only the domains you allow.

The audit’s fix section has the baseline settings, and organisations can enforce them with VS Code policies.