Is Prompt flow for VS Code safe?

Findings

Unmaintained Item

Flags items that are not maintained on the marketplace, suggesting concerns about the item's reputation and the publisher's reliability.

low

Uses Third Party AI Model

Flags items that process data using third-party AI models. AI models can be used to process data in a way that may not be transparent to the user. This can lead to organization policy violation, data leakage, privacy concerns and potential misuse of data.

low

Requires Additional Extensions

Flags items that require one or more other extensions to be installed in order to function. While extension dependencies are a standard software practice, they result in additional extensions being present in the environment.

low

All findings are available for Enterprise users

Code analysis

AI-powered analysis of the extension's source code for security insights and risk assessment.

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

CODE INSIGHTS ARE AVAILABLE FOR ENTERPRISE USERS

API Calls

API calls detected through static analysis of the source code. For more accurate insights, explore our sandbox dynamic analysis.

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

API CALLS ARE AVAILABLE FOR ENTERPRISE USERS

Secrets

Any encoded/decoded secrets we managed to find in the source code, git repository, or related files

Github

/extension/NOTICES

Unverified

All secrets are available for Enterprise users

Vulnerabilities

Known vulnerabilities and security issues detected in the extension's dependencies and code.

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

VULNERABILITIES ARE AVAILABLE FOR ENTERPRISE USERS

External communication

Any identifiers we detected that may indicate external communication from the item's code

http://mozilla.github.io/nunjucks/api.html#filesystemloader

extension/extension.js

https://login.microsoftonline.us/consumers/discovery/v2.0/keys

extension/extension.js

https://aka.ms/azsdk/js/identity/environmentcredential/troubleshoot.`

extension/extension.js

All external communications are available for Enterprise users

Dependencies

Dependencies and third-party libraries used by the extension, including version information and license details.

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

DEPENDENCIES ARE AVAILABLE FOR ENTERPRISE USERS

Licenses & Compliance

Compliance

Compliance status and certifications for the extension and its publisher

Microsoft

Microsoft provides resources indicating their preparation for CCPA compliance related to their products and services. However, there is no specific declaration on the parent company's CCPA compliance because Microsoft does not explicitly have a parent company identified in this context.

Compliant

Microsoft

Microsoft complies with HIPAA and enables its customers to adhere to HIPAA regulations, including the HITECH Act and the Security Rule requirements.

Compliant

Microsoft Corporation

Microsoft Corporation, including its services such as Azure, OneDrive for Business, and SharePoint Online, is certified as compliant with PCI DSS version 3.2 at Service Provider Level 1. This indicates that Microsoft is capable of handling vast amounts of payment card data securely. The compliance standards apply directly to these services, confirming their adherence to PCI DSS guidelines.

Compliant

Licenses

No license text available...