A bug like this shows that there is probably no security reviews done at all in the VS Code team. This would be flagged right away in a threat model review. Qui

A bug like this shows that there is probably no security reviews done at all in the VS Code team. This would be flagged right away in a threat model review. Quite worrying. Also, strange that this doesn't get a bug bounty payout - it's very severe.