How do I know that an Azure Devops Extension does not do anything really bad?
A company that I know of uses Microsoft's Azure Devops platform to manage its software development.
Microsoft also offers a "marketplace" where one can get extensions (plugins); third-party software that provides additional features meant to make the platform more useful.
This is helpful, but is there way a to know what such an extension actually does and does not? Can be absolutely 100% certain it does not send any information anywhere? Or changes anything?
Example: Azure Devops does a poor job of listing all your git repositories, so there are extensions which does that for you. On installing such an extension, it asks for permission for "Code (read)". From a security point of view, that looks like a yuuuge red flag it's a third-party piece of software that has read access to all the source code in the project.
Now, that's only dangerous if it can also reach the outside world, as long as it cannot send any information at all about my code anywhere, I'm safe.
But can I be certain of that? Am I guaranteed that
- It cannot connect to site or service outside the project
- It cannot connect to or talk to other extensions
- It cannot change its permissions through extension updates.
In short: Can an Azure Devops Extension be determined to be secure?
