No. A store malware scan looks for known bad code in a package before it is published. A policy review checks a submission against rules. Neither is a full security review of how an extension behaves over time, and neither limits what it can do once installed. Your own review fills that gap.
Three different checks
People often blur these together when they say an extension is verified.
| Check | What it looks at | What it does not tell you |
|---|---|---|
| Malware scan | The published package, using several antivirus engines | Future updates, intent, data handling |
| Policy review | Compliance with the store's developer program policies | Code quality or absence of bugs |
| Your security review | Permissions, publisher, data flows, need | Nothing automatic, it takes your time |
VS Code's documentation says the Marketplace runs a malware scan on each published package using several antivirus engines, and that an extension is not available to the public until the scan is clear. It also says extensions are signed at publish and the signature is checked at install, confirming integrity and origin.
Google's documentation says the Chrome Web Store reviews submissions for compliance with its developer program policies, using manual and automated systems.
What stays open
Both vendors describe checks at a point in time, with some follow up.
- Chrome says published extensions can be re-reviewed later, with outcomes from no action to immediate takedown.
- VS Code says its Marketplace also runs dynamic detection in a sandboxed environment before publication.
- VS Code also says plainly that the extension host has the same permissions as VS Code itself.
That last point is the heart of it. Once an extension is running, it can read and write files, make network requests and run external processes in the editor's case. A scan at publication does not change that.
Myth and fact
Myth: if it passed the store, it is safe to install on a company laptop. Fact: it passed the store's checks. Those checks are real and useful, but they do not evaluate whether you should trust this publisher with your repositories, tokens and browsing.
Myth: a signature means the code is safe. Fact: a signature confirms integrity and origin. It does not say what the code does. Our post on signing and provenance for plugins goes further.
What to add on your side
- Read the requested permissions and ask whether each is needed.
- Check the publisher and any recent change of ownership or name.
- Prefer narrow site access over all sites.
- Use an allowlist so a store listing does not install itself on laptops.
- Re-check after updates, especially ones that add permissions.
- Assign an owner and a review date.
See also what the VS Code Marketplace checks before an extension goes live and how to vet a VS Code extension before installing.
Safeguard note
Safeguard offers an IDE extension for VS Code, JetBrains and Open VSX, browser extensions, and a free scan at gold.safeguard.sh/scan. It adds your own checks to store checks and does not replace them.
Quick check
Does a malware scan prove an extension is harmless?
No. It checks the published package for malware. It says little about later updates or how the extension handles your data.
What does a signature confirm?
VS Code's documentation says it confirms the package's integrity and origin, not what the code does.
Sources
- Extension runtime security, VS Code documentation
- Chrome Web Store review process, Chrome for Developers
Last reviewed: 19 October 2026.
