Workspace Trust Visual Studio Code Features Agents Docs Documentation API FAQ Release Notes Blog Learn Events Resources Extensions MCP Download Search Download 📼 Rewatch VS Code Live at MS Build 2026 Dismiss this update All Docs Core Editor Overview Write code Tutorial User Interface Tips and Tricks Basic Editing IntelliSense Inline Suggestions Smart Actions Code Navigation Refactoring Snippets Workspaces Overview Multi-Root Workspaces Workspace Trust Configure the editor Display Language Layout Keyboard Shortcuts Settings Settings Sync Extensions Overview Extension Marketplace Extension Runtime Security Themes Profiles Accessibility Overview Voice Interactions Command Line Interface Telemetry Reference Default Keyboard Shortcuts Default Settings Substitution Variables Tasks Schema Topics Overview Tutorial User Interface Tips and Tricks Basic Editing IntelliSense Inline Suggestions Smart Actions Code Navigation Refactoring Snippets Workspaces     Overview     Multi-Root Workspaces     Workspace Trust Display Language Layout Keyboard Shortcuts Settings Settings Sync Extensions     Overview     Extension Marketplace     Extension Runtime Security Themes Profiles Accessibility     Overview     Voice Interactions Command Line Interface Telemetry Default Keyboard Shortcuts Default Settings Substitution Variables Tasks Schema Copy as Markdown Copy as Markdown View as Markdown On this page there are 10 sectionsOn this page Safe code browsing Restricted Mode Trusting a workspace Selecting folders Enabling extensions Opening untrusted files Settings Command-line switch Next steps Common questions Workspace Trust Visual Studio Code takes security seriously and wants to help you safely browse and edit code no matter the source or original authors. The Workspace Trust feature lets you decide whether code in your project folder can be executed by VS Code and extensions without your explicit approval. Note: When in doubt, leave a folder in Restricted Mode. You can always enable trust later. Safe code browsing It's great that there is so much source code available on public repositories and file shares. No matter the coding task or problem, there is probably already a good solution available somewhere. It is also great that there are so many powerful coding tools available to help you understand, debug, and optimize your code. However, using open-source code and tools does have risks, and you can leave yourself open to malicious code execution and exploits. Workspace Trust provides an extra layer of security when working with unfamiliar code, by preventing automatic code execution of any code in your workspace if the workspace is open in "Restricted Mode". Important Workspace trust is shared between your VS Code window and the Agents window. If the workspace is untrusted in VS Code, it is also untrusted in the Agents window, and agents will not run in either place. You can manage workspace trust from either surface, and the trust state is shared across both. Restricted Mode When you open a new, unfamiliar folder, VS Code opens it in Restricted Mode to prevent automatic code execution while you review the contents. VS Code also enters Restricted Mode if you choose No, I don't trust the authors when prompted by the Workspace Trust dialog. The workbench displays a banner at the top with a link to Manage your folder via the Workspace Trust editor. In the Status Bar, you can also see a badge that indicates that the workspace is in Restricted Mode. When you're ready, you can trust the folder from the banner or the Workspace Trust editor. Restricted Mode tries to prevent automatic code execution by disabling or limiting the operation of several VS Code features: AI agents, terminal, tasks, debugging, workspace settings, and extensions. To see the full list of features disabled in Restricted Mode, you can open the Workspace Trust editor via the Manage link in the banner, or by selecting the Restricted Mode badge in the Status Bar. The Workspace Trust editor opens by default in a modal overlay on top of the editor area. Caution Workspace Trust can't prevent a malicious extension from executing code and ignoring Restricted Mode. You should only install and run extensions that come from a well-known publisher that you trust. AI agents When you use AI-powered development features like agents in VS Code, these agents perform actions on your behalf, including making changes to your codebase, running terminal commands, or invoking web requests. Any file could be pulled into the context by using agents and could theoretically result in a prompt injection attack. Until you've reviewed a project for malicious content, rely on the Workspace Trust boundary and open it in restricted mode. Opening a workspace in restricted mode disables agents in that workspace. Learn more about AI security considerations when using AI-powered development features in VS Code. Terminal Shells can automatically execute code based on workspace contents, for example by sourcing .env files or running shell initialization scripts that reference the current directory. To protect against this, opening a terminal is blocked by default when a folder is open in Restricted Mode. If you try to open a terminal while in Restricted Mode, VS Code displays a prompt to confirm that you trust the folder. If you cancel the dialog, VS Code stays in Restricted Mode, and does not open the terminal. If you configure your shell to prevent automatic code execution based on workspace contents, you can enable the terminal.integrated.allowInUntrustedWorkspace Open in VS Code Open in VS Code Insiders setting to allow terminals to open in Restricted Mode without a trust prompt. Tasks VS Code tasks can run scripts and tool binaries. Because task definitions are defined in the workspace .vscode folder, they are part of the committed source code for a repo, and shared to every user of that repo. If someone would create a malicious task, it could be unknowingly run by anyone who cloned that repository. If you try to run or even enumerate tasks (Tasks > Run Task) while in Restricted Mode, VS Code displays a prompt to confirm that you trust the folder and can continue executing the task. If you cancel the dialog, VS Code stays in Restricted Mode. Debugging Similar to running a VS Code task, debug extensions can run debugger binaries when launching a debug session. For that reason, debugging is also disabled when a folder is open in Restricted Mode. If you try to start a debug session (Debug > Start Debugging) while in Restricted Mode, VS Code displays a prompt to confirm that you trust the folder and can continue launching the debugger. If you cancel the dialog, VS Code stays in Restricted Mode, and does not start the debug session. Workspace settings Workspace settings are stored in the .vscode folder at the root of your workspace, and are therefore shared by anyone who clones the workspace repository. Some settings contain paths to executables (for example, linter binaries), which if set to point to malicious code, could cause damage. For this reason, VS Code disables a set of workspace settings when running in Restricted Mode. In the Workspace Trust editor, select the link for workspace settings that aren't being applied to bring up the Settings editor scoped by the @tag:requireTrustedWorkspace tag. Extensions The VS Code extensions ecosystem is incredibly rich and diverse. People have created extensions to help with just about any programming task or editor customization. Some extensions provide full programming language support (IntelliSense, debugging, code analysis), and others let you play music or have virtual pets. Most extensions run code on your behalf and could potentially do harm. Some extensions have settings that could cause them to act maliciously if configured to run an unexpected executable. For this reason, extensions that have not explicitly opted into Workspace Trust are disabled by default in Restricted Mode. You can review an installed extension's status by selecting the extensions are disabled or have limited functionality link in the Workspace Trust editor, which displays the Extensions view scoped with the @workspaceUnsupported filter. Extensions that have not opted into Workspace Trust can be either disabled or limited in Restricted Mode. Disabled in Restricted Mode Extensions that have either not explicitly indicated that they support running in Restricted Mode are shown in the Disabled in Restricted Mode section. An extension author can also indicate that they never want to be enabled in Restricted Mode if they determine that their extension could be misused by modifications (settings or files) in a workspace. Limited in Restricted Mode Extension authors can also evaluate their extensions for possible security vulnerabilities and declare that they have limited support when running in Restricted Mode. This mode means the extension may disable some features or functionality to prevent a possible exploit. Extensions can add custom text to the Workspace Trust badge in the Extensions view, explaining the limitation when running in an untrusted folder. For example, the VS Code built-in PHP extension limits the use of the php.validate.executablePath Open in VS Code Open in VS Code Insiders setting to trusted folders since overriding this setting could run a malicious program. You can override an extension's Workspace Trust support level using the extensions.supportUntrustedWorkspaces Open in VS Code Open in VS Code Insiders setting, described in the Enabling extensions section below. If you try to install an extension in Restricted Mode, you are prompted to either trust the workspace or just install the extension. If the extension doesn't support Workspace Trust, it is installed, but is disabled or runs with limited functionality. Note Extension authors can learn how to update their extensions to support Workspace Trust by reading the Workspace Trust Extension Guide. Trusting a workspace If you trust the authors and maintainers of a project, you can trust the project's folder on your local machine. For example, it is usually safe to trust repositories from well-known GitHub organizations such as github.com/microsoft or github.com/docker. When you open a new folder, it opens in Restricted Mode with a trust banner. Use the banner or the Workspace Trust editor to trust the folder and its subfolders when you're ready. You can also bring up the Workspace Trust editor and quickly toggle a folder's trusted state by selecting the Trust button. There are several ways to bring up the Workspace Trust editor dialog. When in Restricted Mode: Restricted Mode banner Manage link Restricted Mode Status Bar item You can also at any time use: Workspaces: Manage Workspace Trust command from the Command Palette (⇧⌘P (Windows, Linux Ctrl+Shift+P)) Important Workspace trust is shared between your VS Code window and the Agents window. If the workspace is untrusted in VS Code, it is also untrusted in the Agents window, and agents will not run in either place. You can manage workspace trust from either surface, and the trust state is shared across both. Selecting folders When you trust a folder, it is added to the Trusted Folders & Workspaces list that is displayed in the Workspace Trust editor. You can manually add, edit, and remove folders from this list to enable or disable workspace trust. The active folder is highlighted in bold in this list. Selecting a parent folder You can also trust a parent folder, which applies trust to the parent folder and all its subfolders. To trust a parent folder, add its path to the Trusted Folders & Workspaces list in the Workspace Trust editor. Trusting the parent folder can be helpful if you have many folders with trusted content co-located under one folder. When you open a subfolder under a trusted parent, you won't see the usual Don't Trust button to put you back in Restricted Mode. In…