Re: How to make Emacs more secure?

On 2026-05-03, at 10:37, Stéphane Marks <[email protected]> wrote:

> Aside from a baseline "audit," this feature coming in Emacs 31 will help for package upgrades.  AFAIK, the same does not exist
> in VSCode and if that's an approved tool, then Emacs, used correctly, should exceed VSCode's default security posture.

As I said in the previous message, not necessarily.  `emacs --eval` can
do /everything/ the user can do.  I am not sure if a typical editor/IDE
like VSCode can do the same - it's possible these tools have some sort
of sandboxes Emacs doesn't have.

Also, a rogue package is not necessarily the biggest security risk.
A rogue skill and a coding agent writing some malicious Elisp might be
a bigger issue.

Best,

-- 
Marcin Borkowski
https://mbork.pl