[sshine]

> Some software, such as Visual Studio Code and derivatives, has very lax policies on extensions. Even if you install it from a trusted source, but then install an untrusted extension, the extension will run with full access to your files!

Installing VSCodium on NixOS, you need to specify the extensions as part of your system configuration. This means extensions get pinned. But beyond that, they still have full user access.