microsoft / microsoft/vscode-remote-release
Bug: Missing First Class Secrets Support
@chrmarti is already working on this.
Since Apr 9, 2026.
- Dominant language
- Dockerfile
- Stars
- 4.2k
- Forks
- 469
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 1
Description
The Dev Container Spec#219 and CLI#493 have already finalized and implemented First Class Secrets Support.
However, the VS Code Dev Containers extension currently lacks this implementation.
This creates a security parity gap: users are still forced to pass sensitive credentials via remoteEnv, leading to potential secret leakage—the exact vulnerability this spec was designed to resolve.
The extension should be compliant with the official specification, supporting secure, dynamic secret injection (e.g., via Windows Credential Manager, macOS Keychain) without requiring a container rebuild.
Since the CLI already supports this, when will the VS Code extension bridge this gap to ensure secure secret handling?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.