"VSCode extensions are an abused and exposed attack vertical, with zero visibility, high impact, and high risk. This issue poses a direct threat to organizations and deserves the security ...

The VSCode.dev browser client, which uses the CLI and permissions to create a tunnel. I’m using a Debian compute instance on Google Cloud Platform (GCP) but any type and provider will work.