Security at Scale: How Open VSX Is Raising the Bar

This report describes Open VSX’s shift from reactive to preventive security: implementing pre-publication verification (similarity checks, secret and malware scanning), hardening the build and release pipeline, tightening credential and token handling, improving containment and observability (rate limiting, download monitoring), and beginning SBOM work to better manage dependency risk.