Use VS Code profiles to keep risky extensions away from client code

VS Code profiles are named sets of settings, extensions, keyboard shortcuts, MCP servers, snippets, tasks and layout. A profile is tied to a folder or workspace, so you can keep experimental extensions in one profile and run a minimal set when you open sensitive code.

What a profile holds

According to the documentation, a profile can include all customization types or a subset. Anything you exclude comes from the Default Profile. Profiles can be exported to a secret GitHub gist or a local .code-profile file, and machine specific settings such as local paths are not exported.

Why this is a security feature

Extensions run with your permissions and see whatever the editor can see. If you try a new extension in a window that also has your client's repository open, it runs next to that code. A separate profile lets you try things in a window with nothing sensitive in reach.

A three profile layout

• Minimal. Only extensions you trust and need: language support, a formatter, your security scanning extension. Use it for production code and client work.
• Daily. Your normal set.
• Sandbox. For trying new extensions and themes. Never open sensitive repositories with it.

Setting it up

1. Open File > Preferences > Profiles, or the Manage gear.
2. Select New Profile, name it, and choose contents. An Empty Profile disables all extensions and modified settings.
3. Open the folder you want the profile tied to. The documentation says that when you create or select a profile it is associated with the current folder or workspace.
4. Review associations in the Folders and Workspaces section. Developer: Reset Workspace Profiles Associations removes them without deleting profiles.

To keep one extension in every profile, use Apply Extension to all Profiles in the Extensions view. Use it sparingly.

Profiles do not replace other controls

Profiles organise your choices. They do not stop an extension from running in the window where it is enabled. Combine them with Workspace Trust and an allowlist where you manage a team.

Sync note

Settings Sync can carry profiles across machines, but VS Code does not synchronize extensions to or from remote windows such as SSH, dev containers or WSL. If you rely on a profile for a remote session, check which extensions are actually installed there.

An example for contractors and consultants

If you work for several clients, create one profile per client and tie each to the folder that holds that client's code. Install only the extensions the client work needs. When you open the folder, the matching profile loads. You avoid one client's tools reading another client's code, and you can export each profile to document what was installed if a client asks.

Keep profiles lean

The temptation is to copy your Default Profile into every new one. Resist it. A profile earns its value by being smaller. Start from an Empty Profile and add only what you miss. Review the list when you review your extension inventory.

Quick check

Sources

• Profiles in VS Code

Last reviewed: 19 October 2026.