Visual Studio Code

Below the B minimum (70/100) in our RFP clause. A buyer using it would ask for a dated fix for each missing header.

With these headers missing, code.visualstudio.com is more exposed to clickjacking.

Missing 5

• Referrer-Policy 0 of 10

  Limits how much of the current URL is passed to other sites when a user follows a link or the page loads a third-party resource.

  Without it: Full URLs, including paths and query strings that can carry document IDs, search terms, customer names or reset tokens, can leak to every outside script, image host and outbound link. Recent browsers default to a safer policy; older ones and embedded webviews do not.

• Permissions-Policy 0 of 10

  Switches off browser features the product does not use, such as camera, microphone, location and payments, for the page and anything embedded in it.

  Without it: Any script or iframe on the page, including third-party ads and chat widgets, can ask the user for camera, microphone or location access under the vendor's name.

• Cross-Origin-Opener-Policy 0 of 5

  Cuts the link between the product's window and windows opened by, or opening, other sites.

  Without it: A page that opens the product keeps a handle on its window and can later redirect it to a look-alike sign-in or payment page (tab-nabbing) while the user thinks they are still on the real site. It is also part of the isolation browsers need to defend against Spectre-style attacks.

• Cross-Origin-Resource-Policy 0 of 5

  Tells browsers which sites may load this site's resources.

  Without it: Other sites can pull the product's responses into their own pages, which makes side-channel leaks of what a signed-in user can see easier.

• No version disclosure 0 of 5

  Keeps the Server and X-Powered-By headers from announcing exact software versions.

  Without it: A header like "nginx/1.18.0" or "PHP/7.4" tells an attacker which known vulnerabilities to try, and flags possibly unpatched software to every automated scanner on the internet.

Sent 4

• Content-Security-Policy 25 of 25

  frame-ancestors 'self'

• Strict-Transport-Security 20 of 20

  max-age=31536000; includeSubDomains

• X-Content-Type-Options 10 of 10

  nosniff

• Frame protection 10 of 10

  CSP frame-ancestors

Checked 2026-10-18 at https://code.visualstudio.com/. Re-checked every 7 days. The grade covers the headers this website sends, not the product’s overall security. How the grade works.