vs-pullouts

Audits installed VS Code extensions (mac/linux, all forks) and checks their GitHub repos for advisories + bundled npm deps for OSV vulns.

Prereqs:

• a golang toolchain (brew install go)

• just run-all does everything

• just run is what you'll use most of the time.

• just audit [--min-age 6m] writes vscode_audit.json / .md; exits non-zero if anything is staler than --min-age (e.g. 2d/3w/6m/2y).

• just sec [--fail-on high] reads the audit, queries GitHub + OSV, writes vscode_sec.json / .md.

• just build produces static binaries in bin/; just fmt / just lint / just test for tooling.

Tokens

Only GitHub needs a token, and only to lift the rate limit from 60→5000 req/hr.

• Classic: https://github.com/settings/tokens
• Fine-grained: https://github.com/settings/personal-access-tokens/new

Although you don't need a token this tool makes usage of https://osv.dev/