🛠 5 VS Code extensions I still use after 10 years
Not "top 20 extensions." Twenty extensions make your editor slow and your brain tired. These five earn their place.
1️⃣ Error Lens
Shows the error inline, on the line, in red - instead of hiding it in the Problems panel. Sounds trivial. Cuts your debugging time more than anything else on this list. Install this one first.
2️⃣ GitLens
Hover any line and see who wrote it, when, and in which commit. When you join a real codebase, this is the difference between "why is this here?" and knowing the answer in two seconds.
3️⃣ Prettier + ESLint
Prettier formats, ESLint catches mistakes. Set "format on save" and never think about spacing again. Together they end 90% of the arguments a junior has with their own code.
4️⃣ Path Intellisense
Autocompletes file paths in imports. Small. You'll notice it every single day.
5️⃣ Quokka.js
Runs JavaScript as you type and shows the value of every variable next to it. For learning, this is the closest thing to seeing the code think.
❌ What I don't install anymore:
theme packs, icon packs, bracket colorizers (built into VS Code now), and any extension that adds a sidebar icon I'll never click. Every extension costs startup time and attention. Five good ones beat twenty.
What's the one extension you'd defend? 👇
#tools @codingforweb
Not "top 20 extensions." Twenty extensions make your editor slow and your brain tired. These five earn their place.
1️⃣ Error Lens
Shows the error inline, on the line, in red - instead of hiding it in the Problems panel. Sounds trivial. Cuts your debugging time more than anything else on this list. Install this one first.
2️⃣ GitLens
Hover any line and see who wrote it, when, and in which commit. When you join a real codebase, this is the difference between "why is this here?" and knowing the answer in two seconds.
3️⃣ Prettier + ESLint
Prettier formats, ESLint catches mistakes. Set "format on save" and never think about spacing again. Together they end 90% of the arguments a junior has with their own code.
4️⃣ Path Intellisense
Autocompletes file paths in imports. Small. You'll notice it every single day.
5️⃣ Quokka.js
Runs JavaScript as you type and shows the value of every variable next to it. For learning, this is the closest thing to seeing the code think.
❌ What I don't install anymore:
theme packs, icon packs, bracket colorizers (built into VS Code now), and any extension that adds a sidebar icon I'll never click. Every extension costs startup time and attention. Five good ones beat twenty.
What's the one extension you'd defend? 👇
#tools @codingforweb
🔓 45% of AI-generated code contains a security vulnerability.
Veracode tested this properly: 80 curated coding tasks, run across 100+ large language models. Not vibes — a benchmark.
Results:
▪️ 45% of generated code introduced an OWASP Top 10 vulnerability
▪️ Java: 70%+ failure rate - the worst by far
▪️ Python, C#, JavaScript: 38 - 45%
▪️ Cross-site scripting (CWE - 80): 86% failure rate
▪️ Log injection (CWE - 117): 88% failure rate
And the line that should worry you most:
"Despite advances in LLMs' ability to generate syntactically correct code, security performance has not kept up, remaining unchanged over time." Models got dramatically better at writing code that works. They did not get better at writing code that's safe. Those two things improved on completely different curves, and almost nobody noticed. Because here's the thing about a security bug: it passes your tests. It passes code review. It works perfectly - right up until it doesn't.
🔖 Save this. Six things to check in every piece of AI code you ship:
1️⃣ Any user input rendered to a page → is it escaped? (XSS)
2️⃣ Any user input reaching the database → parameterized query, never string concatenation (SQL injection)
3️⃣ Any user input written to logs → stripped of newlines (log injection)
4️⃣ Any file path built from user input → validated against traversal (../)
5️⃣ Any secret, key, or token → in env vars, never in the code it just wrote
6️⃣ Any dependency it imported → does that package actually exist? (AI invents package names, and attackers register them)
Number 6 is the one nobody checks. It has a name now: slopsquatting.
📎 Source: Veracode 2025 GenAI Code Security Report
Please send this to the person on your team who ships AI code the fastest.
#tools @codingforweb
Veracode tested this properly: 80 curated coding tasks, run across 100+ large language models. Not vibes — a benchmark.
Results:
▪️ 45% of generated code introduced an OWASP Top 10 vulnerability
▪️ Java: 70%+ failure rate - the worst by far
▪️ Python, C#, JavaScript: 38 - 45%
▪️ Cross-site scripting (CWE - 80): 86% failure rate
▪️ Log injection (CWE - 117): 88% failure rate
And the line that should worry you most:
"Despite advances in LLMs' ability to generate syntactically correct code, security performance has not kept up, remaining unchanged over time." Models got dramatically better at writing code that works. They did not get better at writing code that's safe. Those two things improved on completely different curves, and almost nobody noticed. Because here's the thing about a security bug: it passes your tests. It passes code review. It works perfectly - right up until it doesn't.
🔖 Save this. Six things to check in every piece of AI code you ship:
1️⃣ Any user input rendered to a page → is it escaped? (XSS)
2️⃣ Any user input reaching the database → parameterized query, never string concatenation (SQL injection)
3️⃣ Any user input written to logs → stripped of newlines (log injection)
4️⃣ Any file path built from user input → validated against traversal (../)
5️⃣ Any secret, key, or token → in env vars, never in the code it just wrote
6️⃣ Any dependency it imported → does that package actually exist? (AI invents package names, and attackers register them)
Number 6 is the one nobody checks. It has a name now: slopsquatting.
📎 Source: Veracode 2025 GenAI Code Security Report
Please send this to the person on your team who ships AI code the fastest.
#tools @codingforweb
⚡️ Only 31% of developers use AI agents. That gap is about to decide a lot.
Buried in the Stack Overflow 2026 survey is a split almost nobody is talking about - and it's much bigger than the "do you use AI" question. Autocomplete is universal now. 84% use it. It's table stakes.
Agents - tools that run tasks, edit multiple files, execute commands - are not:
▪️ 31% of developers use agents
▪️ 38% have no plans to start
▪️ 69% of agent users report increased productivity
▪️ PR turnaround among them: 9.6 days → 2.4 days
That last number is a 4x change in how fast work moves through a team. Not a tweak. A different operating speed.
Also from the same survey, on tooling:
▪️ VS Code: 75.9%
▪️ Cursor: 17.9% - the fastest first-year debut the survey has ever recorded
▪️ Claude Code: 9.7%
The pattern is clear: developers aren't replacing their editor. They're adding an agent next to it. Here's why this matters more than the productivity number. When 69% of one group ships four times faster, that group isn't just more productive. Within a year, it's the group that sets what "normal output" means - for teams, for hiring, for what a job posting expects you to know. The gap isn't between people who use AI and people who don't. That question is settled. It's between people who let AI complete a line and people who let it complete a task.
🎯 Do this week:
Take one boring task you've been avoiding - a test suite nobody wrote, a migration, a refactor across five files. Give it to an agent end-to-end. Don't help it. Watch where it fails.
You'll learn more in one afternoon than from fifty tutorials, and you'll know exactly which half of that 31/69 split you belong in.
📎 Source: Stack Overflow Developer Survey 2026
Forward to someone still using AI only for autocomplete.
#tools @codingforweb
Buried in the Stack Overflow 2026 survey is a split almost nobody is talking about - and it's much bigger than the "do you use AI" question. Autocomplete is universal now. 84% use it. It's table stakes.
Agents - tools that run tasks, edit multiple files, execute commands - are not:
▪️ 31% of developers use agents
▪️ 38% have no plans to start
▪️ 69% of agent users report increased productivity
▪️ PR turnaround among them: 9.6 days → 2.4 days
That last number is a 4x change in how fast work moves through a team. Not a tweak. A different operating speed.
Also from the same survey, on tooling:
▪️ VS Code: 75.9%
▪️ Cursor: 17.9% - the fastest first-year debut the survey has ever recorded
▪️ Claude Code: 9.7%
The pattern is clear: developers aren't replacing their editor. They're adding an agent next to it. Here's why this matters more than the productivity number. When 69% of one group ships four times faster, that group isn't just more productive. Within a year, it's the group that sets what "normal output" means - for teams, for hiring, for what a job posting expects you to know. The gap isn't between people who use AI and people who don't. That question is settled. It's between people who let AI complete a line and people who let it complete a task.
🎯 Do this week:
Take one boring task you've been avoiding - a test suite nobody wrote, a migration, a refactor across five files. Give it to an agent end-to-end. Don't help it. Watch where it fails.
You'll learn more in one afternoon than from fifty tutorials, and you'll know exactly which half of that 31/69 split you belong in.
📎 Source: Stack Overflow Developer Survey 2026
Forward to someone still using AI only for autocomplete.
#tools @codingforweb
This media is not supported in your browser
VIEW IN TELEGRAM
🔓 45% of AI-generated code contains a security vulnerability.
Veracode tested this properly: 80 curated coding tasks, run across 100+ large language models. Not vibes — a benchmark.
Results:
▪️ 45% of generated code introduced an OWASP Top 10 vulnerability
▪️ Java: 70%+ failure rate - the worst by far
▪️ Python, C#, JavaScript: 38 - 45%
▪️ Cross-site scripting (CWE - 80): 86% failure rate
▪️ Log injection (CWE - 117): 88% failure rate
And the line that should worry you most:
"Despite advances in LLMs' ability to generate syntactically correct code, security performance has not kept up, remaining unchanged over time." Models got dramatically better at writing code that works. They did not get better at writing code that's safe. Those two things improved on completely different curves, and almost nobody noticed. Because here's the thing about a security bug: it passes your tests. It passes code review. It works perfectly - right up until it doesn't.
🔖 Save this. Six things to check in every piece of AI code you ship:
1️⃣ Any user input rendered to a page → is it escaped? (XSS)
2️⃣ Any user input reaching the database → parameterized query, never string concatenation (SQL injection)
3️⃣ Any user input written to logs → stripped of newlines (log injection)
4️⃣ Any file path built from user input → validated against traversal (../)
5️⃣ Any secret, key, or token → in env vars, never in the code it just wrote
6️⃣ Any dependency it imported → does that package actually exist? (AI invents package names, and attackers register them)
Number 6 is the one nobody checks. It has a name now: slopsquatting.
📎 Source: Veracode 2025 GenAI Code Security Report
Please send this to the person on your team who ships AI code the fastest.
#tools @codingforweb
Veracode tested this properly: 80 curated coding tasks, run across 100+ large language models. Not vibes — a benchmark.
Results:
▪️ 45% of generated code introduced an OWASP Top 10 vulnerability
▪️ Java: 70%+ failure rate - the worst by far
▪️ Python, C#, JavaScript: 38 - 45%
▪️ Cross-site scripting (CWE - 80): 86% failure rate
▪️ Log injection (CWE - 117): 88% failure rate
And the line that should worry you most:
"Despite advances in LLMs' ability to generate syntactically correct code, security performance has not kept up, remaining unchanged over time." Models got dramatically better at writing code that works. They did not get better at writing code that's safe. Those two things improved on completely different curves, and almost nobody noticed. Because here's the thing about a security bug: it passes your tests. It passes code review. It works perfectly - right up until it doesn't.
🔖 Save this. Six things to check in every piece of AI code you ship:
1️⃣ Any user input rendered to a page → is it escaped? (XSS)
2️⃣ Any user input reaching the database → parameterized query, never string concatenation (SQL injection)
3️⃣ Any user input written to logs → stripped of newlines (log injection)
4️⃣ Any file path built from user input → validated against traversal (../)
5️⃣ Any secret, key, or token → in env vars, never in the code it just wrote
6️⃣ Any dependency it imported → does that package actually exist? (AI invents package names, and attackers register them)
Number 6 is the one nobody checks. It has a name now: slopsquatting.
📎 Source: Veracode 2025 GenAI Code Security Report
Please send this to the person on your team who ships AI code the fastest.
#tools @codingforweb
❤1🔥1
🔬 30-second experiment. Ask AI for npm packages — then check if they exist.
Do this right now, before reading further:
Open your AI of choice and ask:
"Give me 5 npm packages for validating and sanitising user input in Express."
Now take each name and run:
Count how many don't exist.
——————
I'll tell you what the research says, but do it yourself first — the number means nothing until it's your number. A study across 16 models generated 576,000 code samples. Of every package name the models recommended:
▪️ 19.7% did not exist
▪️ Open-source models: 21.7% hallucinated
▪️ Commercial models: 5.2%
▪️ Total unique fake package names produced: over 205,000
And the models are consistent about it. Ask the same question twice and you often get the same invented name — which is precisely what makes this exploitable.
Here's the part that turns a curiosity into a threat. A researcher noticed models kept recommending a package called
The attack has a name now: slopsquatting.
Register the package the AI invents, wait for people to install it.
🎯 Three seconds of defence:
Before you install anything an AI suggested, check the package page. Look at weekly downloads and the publish date. A real utility library with 40 downloads and a first release from last Tuesday is not a library. It's bait.
💬 Run the test and post your score in the comments. Which model, how many fake out of 5. I'm genuinely curious whether it's got better or worse.
📎 Source: "We Have a Package for You!" — USENIX Security
Forward this to someone who installs whatever the AI says.
#tools @codingforweb
Do this right now, before reading further:
Open your AI of choice and ask:
"Give me 5 npm packages for validating and sanitising user input in Express."
Now take each name and run:
npm view \<package-name>Count how many don't exist.
——————
I'll tell you what the research says, but do it yourself first — the number means nothing until it's your number. A study across 16 models generated 576,000 code samples. Of every package name the models recommended:
▪️ 19.7% did not exist
▪️ Open-source models: 21.7% hallucinated
▪️ Commercial models: 5.2%
▪️ Total unique fake package names produced: over 205,000
And the models are consistent about it. Ask the same question twice and you often get the same invented name — which is precisely what makes this exploitable.
Here's the part that turns a curiosity into a threat. A researcher noticed models kept recommending a package called
huggingface-cli. It didn't exist. So he registered it — empty, harmless, as a test. It got over 30,000 downloads in three months. Nobody attacked anyone. He just put a name where the hallucination pointed, and thousands of developers installed it because their AI told them to.The attack has a name now: slopsquatting.
Register the package the AI invents, wait for people to install it.
🎯 Three seconds of defence:
Before you install anything an AI suggested, check the package page. Look at weekly downloads and the publish date. A real utility library with 40 downloads and a first release from last Tuesday is not a library. It's bait.
💬 Run the test and post your score in the comments. Which model, how many fake out of 5. I'm genuinely curious whether it's got better or worse.
📎 Source: "We Have a Package for You!" — USENIX Security
Forward this to someone who installs whatever the AI says.
#tools @codingforweb