🎓 VS Code Zero-Day Case: Full Disclosure Ethics Guide
The VS Code zero-day incident underscores a critical reality: vulnerabilities exist in every software stack, and protecting your development environment is just as important as securing your passwords. A comprehensive security solution like Kaspersky Premium helps safeguard your devices against exploits, malicious extensions, and zero-day attacks while you work.
How One VS Code Vulnerability Exposed the Fault Lines in Security Disclosure
In 2022, a researcher demonstrated remote code execution in VS Code via a malicious workspace file, and the resulting disclosure argument became a case study in how not to handle a zero-day. Here is a practical, no-nonsense guide to doing it right.
What Actually Happened With the VS Code RCE
CVE-2022-41034 allowed an attacker to execute arbitrary code by convincing a developer to open a crafted workspace file or click a specially constructed `vscode://` URI. The vulnerability affected VS Code versions before 1.71.1 and stemmed from insufficient validation of workspace trust settings combined with how VS Code handled restricted mode bypass.
The case became controversial not because of the bug itself, RCE via malformed input is a well-understood class, but because of what happened after discovery. The researcher published a proof-of-concept before Microsoft had shipped a patch to all affected users, triggering a heated public debate about timelines, responsibility, and whether developer tools deserve the same disclosure standards applied to, say, a hospital's patient management system.
VS Code is installed on over 73% of professional developers according to the Stack Overflow Developer Survey 2024, which puts any severe vulnerability in its attack surface squarely in the "high-impact" category. A zero-day here does not threaten one organisation; it threatens the supply chain feeding every organisation that employs software engineers.
What Full Disclosure Actually Means
Full disclosure, in the strict sense, means publishing all technical details, proof-of-concept code, exploitation steps, affected versions, without waiting for a vendor patch. The term is often used loosely to mean anything from "told the vendor and also tweeted about it" to "dumped the exploit on a public mailing list at midnight."
The distinction matters legally and ethically. Three frameworks dominate the current conversation:
| Framework | Definition | Timeline | Who Favours It |
|---|---|---|---|
| Full Disclosure | Publish everything immediately | Zero days after discovery | Some independent researchers, transparency advocates |
| Responsible Disclosure | Notify vendor privately, publish after patch | Vendor-defined; often indefinite | Vendors, enterprise security teams |
| Coordinated Vulnerability Disclosure (CVD) | Notify vendor, agree on deadline, publish regardless | 90 days is the de facto standard | Google Project Zero, CISA, HackerOne |
CVD has largely won the argument in professional circles. Google Project Zero formalised the 90-day deadline in 2013, and their data bears it out: vendors with a fixed deadline patch roughly 2.5x faster than those given open-ended timelines, according to Project Zero's own publication statistics from 2021.
The 90-Day Rule and Why It Exists
The 90-day deadline is not arbitrary. It balances two competing pressures: giving vendors enough time to develop, test, and deploy a patch across a diverse user base, while ensuring that bugs do not languish silently in vendor backlogs indefinitely.
Microsoft's own Security Response Centre publicly acknowledges that complex RCE vulnerabilities in widely distributed software require between 30 and 90 days to patch safely. Extensions to 120 days are occasionally granted when a fix requires significant architectural changes or coordinated action across multiple teams.
The data supports the 90-day norm. A 2020 analysis published by RAND Corporation found that the median time for a vulnerability to be exploited in the wild after discovery is approximately 22 days. By day 90, a significant fraction of affected users have either patched or been exposed regardless of researcher publication. Keeping a vulnerability secret beyond 90 days therefore helps attackers more than it helps defenders.
For the VS Code case specifically, the patch was available within the standard response window. The dispute arose because the researcher published technical details, including a working PoC, while Microsoft's update pipeline was still rolling out to enterprise users who receive updates on a delayed cycle.
Step-by-Step: How to Handle a Zero-Day Responsibly
If you discover a critical vulnerability in developer tooling, follow this sequence precisely:
**1. Document before you do anything else.** Record the affected version, reproduction steps, impact assessment, and your discovery date with timestamps. Use a private, encrypted note or local file, not a cloud service that might auto-sync.
**2. Identify the correct reporting channel.** Most major vendors publish a security.txt file at `/.well-known/security.txt` or a dedicated security advisory page. For VS Code, that is Microsoft's MSRC portal at msrc.microsoft.com. For extensions, it is the extension author's repository or security contact.
**3. Send an encrypted initial report.** Use PGP if the vendor publishes a key. Include: affected component, version range, reproduction steps, impact, and your intended public disclosure date. State the deadline clearly, "I intend to publish details on [date] unless an earlier patch is available."
**4. Set a calendar reminder for your deadline.** Do not let the deadline slip quietly. Vendors sometimes go silent to run out the clock.
**5. If you receive no response within 7 days, escalate.** Try a secondary contact. For major vendors, CERT/CC or CISA can act as neutral intermediaries.
**6. If the deadline passes without a patch or substantive communication, publish.** Redact personally identifiable information, state clearly what is and is not patched, and provide mitigation guidance for users who cannot yet patch.
**7. Do not publish working exploit code unless absolutely necessary for users to understand the severity.** A technical description and impact assessment almost always suffices.
Legal Exposure Every Researcher Must Understand
Security research exists in a legally ambiguous space in most jurisdictions. In the United Kingdom, the Computer Misuse Act 1990 has no explicit research exemption. In the United States, the Computer Fraud and Abuse Act (CFAA) has been used against researchers even when their intent was demonstrably defensive.
The critical protective factors are:
- **Authorisation**: Did you have permission to test the system? Fuzzing a local VS Code installation you own is categorically different from probing a remote deployment.
- **Intent**: Commercial bug bounty programmes and coordinated disclosure with contemporaneous documentation establish good faith.
- **No access beyond necessity**: If you confirmed the vulnerability with minimal data access, document that. Do not extract real user data to prove a point.
The United Kingdom's Law Commission recommended in its 2020 Computer Misuse Act review that a statutory public interest defence be added for legitimate security research. As of 2025, that recommendation has not been enacted into law. Bug bounty participation provides some legal cover because vendors contractually waive prosecution for authorised research within defined scope.
For the VS Code ecosystem specifically, Microsoft's Bug Bounty programme covers VS Code and VSCodium with rewards ranging from recognition to cash payments for qualifying vulnerabilities. Participation places you inside an explicit legal safe harbour.
When Vendors Go Silent: Escalation Paths
A vendor going silent is more common than it should be. If you hit day 14 with no acknowledgement, escalate in this order:
**CERT/CC (Carnegie Mellon University)**: Acts as a neutral third-party coordinator. Particularly effective when the vendor is a large organisation with bureaucratic response processes.
**CISA (US Cybersecurity and Infrastructure Security Agency)**: Handles coordinated disclosure for critical infrastructure and widely used software. Publish-worthy for anything affecting developer toolchains.
**National CERT for the vendor's home jurisdiction**: NCSC in the UK, BSI in Germany, JPCERT/CC in Japan.
**Public pressure via responsible channels**: If the vendor is unresponsive and your deadline has passed, a post on a respected security research platform, Full Disclosure mailing list, your own blog with clear technical detail, is legitimate. Do not tweet a PoC as your first escalation step.
For VS Code's extension ecosystem, GitHub Security Advisories offers a coordinated path specifically for open-source repositories. Because most VS Code extensions are hosted on GitHub, this is often the most direct route for extension-level vulnerabilities.
Applying These Lessons Beyond VS Code
The VS Code case is instructive precisely because VS Code is a developer tool. Vulnerabilities in developer tools carry compounding risk: a compromised IDE can exfiltrate source code, inject malicious code into builds, or steal credentials used across dozens of downstream systems.
The same logic applies to other tooling in the modern development stack, Git clients, package managers, containerisation tools, CI/CD agents. Each represents a high-value target and each warrants the same disciplined disclosure process.
A useful mental model: ask whether the vulnerability is in the path between a developer and their production environment. If yes, treat it with the same urgency you would give a vulnerability in authentication infrastructure. The developer's machine is, functionally, a privileged access workstation.
Researchers who treat developer tools as lower-stakes than enterprise software because they sit on individual machines rather than servers are making the same mistake vendors made before supply chain attacks became the dominant threat vector.
---
FAQs
What is the difference between responsible disclosure and coordinated vulnerability disclosure?
Responsible disclosure is an older term that generally meant notifying the vendor and waiting indefinitely for a patch before going public. Coordinated vulnerability disclosure (CVD) introduces a fixed deadline, typically 90 days, after which the researcher publishes regardless of patch status. CVD gives vendors strong incentive to move quickly and protects researchers from vendors who would otherwise stall indefinitely.
Can I be prosecuted for reporting a VS Code vulnerability even if I acted in good faith?
In most jurisdictions, yes, theoretically. The Computer Misuse Act 1990 in the UK and the CFAA in the US both lack explicit safe harbours for security researchers. In practice, prosecutors rarely pursue researchers who reported responsibly, caused no harm, and accessed only systems they own or had permission to test. Participating in Microsoft's official Bug Bounty programme provides contractual protection within the programme's defined scope.
What should I include in an initial vulnerability report to a vendor?
Include: the affected product and version range, a precise description of the vulnerability class (e.g., "path traversal in extension installation"), step-by-step reproduction instructions, your assessment of exploitability and impact, your discovery date, and your intended public disclosure date. Do not include working exploit code in the initial report, a PoC that proves the issue is present is sufficient.
How do I handle a VS Code extension vulnerability when the author is unresponsive?
Start with a private issue on the extension's GitHub repository if it is open source, or a direct email if contact details are listed. If you receive no response within 14 days, open a GitHub Security Advisory on the repository, which notifies the maintainer privately via GitHub's own system. If that fails, escalate to CERT/CC. For extensions with very large install bases (over 100,000 users), contacting Microsoft's MSRC is also appropriate, as they can apply pressure through the extension marketplace.
Does publishing a zero-day without a patch ever serve the public interest?
Rarely, but yes. If a vendor has demonstrably known about a vulnerability for over six months with no patch, no communication, and no mitigation guidance, and if the vulnerability is actively being exploited in the wild, publication can shift the balance toward helping defenders rather than attackers. This threshold is high and must be documented clearly. Publication in these circumstances should always include mitigation guidance, configuration changes, temporary workarounds, detection signatures, so that affected users have something actionable to do before a patch arrives.