1

How do I know that an Azure Devops Extension does not do anything really bad?

A company that I know of uses Microsoft's Azure Devops platform to manage its software development.

Microsoft also offers a "marketplace" where one can get extensions (plugins); third-party software that provides additional features meant to make the platform more useful.

This is helpful, but is there way a to know what such an extension actually does and does not? Can be absolutely 100% certain it does not send any information anywhere? Or changes anything?

Example: Azure Devops does a poor job of listing all your git repositories, so there are extensions which does that for you. On installing such an extension, it asks for permission for "Code (read)". From a security point of view, that looks like a yuuuge red flag it's a third-party piece of software that has read access to all the source code in the project.

Now, that's only dangerous if it can also reach the outside world, as long as it cannot send any information at all about my code anywhere, I'm safe.

But can I be certain of that? Am I guaranteed that

  • It cannot connect to site or service outside the project
  • It cannot connect to or talk to other extensions
  • It cannot change its permissions through extension updates.

In short: Can an Azure Devops Extension be determined to be secure?

1

Can't comment yet, but most extensions host their source code publicly. So you could read the source code to check if something is going on that you don't want.

If the source code is not available, you could check the company for certain certifications like ISO 27001 or the like so you know they get audited.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.