Re: How to make Emacs more secure?

On Sun, May 17, 2026 at 9:01 AM <[email protected]> wrote:

> On 2026-05-03, at 10:37, Stéphane Marks <[email protected]> wrote:
>
> > Aside from a baseline "audit," this feature coming in Emacs 31 will help
> for package upgrades.  AFAIK, the same does not exist
> > in VSCode and if that's an approved tool, then Emacs, used correctly,
> should exceed VSCode's default security posture.
>
> As I said in the previous message, not necessarily.  `emacs --eval` can
> do /everything/ the user can do.  I am not sure if a typical editor/IDE
> like VSCode can do the same - it's possible these tools have some sort
> of sandboxes Emacs doesn't have.
>
> Also, a rogue package is not necessarily the biggest security risk.
> A rogue skill and a coding agent writing some malicious Elisp might be
> a bigger issue.
>

That's comparing package updates to intentionally self-inflicted wounds.