All Widgets | From the briefing: Your IDE Marketplace Is Stealing Your AI Keys
Read the Briefing
Trust Ledger

Which IDE marketplace plugin categories are worth the trust budget?

Marketplace publishing is the trust boundary that keeps failing. Aikido's June 2026 JetBrains disclosure – fifteen plugins under seven vendor accounts, roughly seventy thousand installs, plaintext key exfiltration running since October 2025 – was a marketplace-operator failure dressed as a vendor-vetting problem. This ledger sorts IDE plugin categories by credential scope and by who actually owns the mitigation. Toggle the categories your organization allows. The trust budget updates to show how many high-scope surfaces you have signed up for, and the recommended attestations you should be requiring before install. The scenario lives in Your IDE Marketplace Is Stealing Your AI Keys.
Interactive Widget · Marketplace Trust Ledger
Every plugin category you allow is a credential surface you inherit.
Toggle the plugin categories your organization currently permits. Click any row to see the incidents, the questions procurement should be asking, and where the mitigation actually sits.
High-scope surfaces enabled
0of 3
Governance posture
Untested
Toggle the plugin categories your engineering org currently allows. The recommendation updates once you have a real baseline.
Category Credential scope Marketplace owner Vendor owner Recommended attestation
High Medium Low
Click any row to expand incident references and attestation questions.
Back to the briefing