IDE extension community
Risk level
medium
50/100

Qodo (Codium) ↗

Qodo (Codium) is a community-maintained IDE extension from Qodo. Anomity scores its risk at 50 out of 100 (medium).

filesystem:read network:outbound credentials:access

Analysis summary

Qodo (Codium) is a community-maintained IDE extension from Qodo. Anomity scores its risk at 50 out of 100 (medium).

Qodo, formerly known as CodiumAI, is an AI extension focused on test generation and automated code review rather than the general chat-and-completion category. Inside the IDE it reads the function the developer is working on, proposes a set of behavioral tests, and surfaces likely edge-case failures; in the pull request flow it leaves contextual review comments on changed code through a companion GitHub app.

Declared capabilities include reading files in the open workspace to gather context for test generation and review, making outbound network requests to Qodo's hosted service for model inference, and accessing the user's Qodo and provider credentials stored in the IDE secret store. The extension does not request filesystem write or shell execute permissions — generated tests are inserted by the IDE on acceptance, and any test execution happens through the user's own commands.

Qodo is community trust because it is an independent vendor. The credential plus outbound network pairing produces a routine risk signal but does not match any dangerous combination. The notable cost is the same as any SaaS coding assistant: the source code being reviewed is transmitted to the vendor on each request, so teams in regulated environments should validate the data-handling agreement before rollout.

Why this entry scored 50 out of 100

This profile starts at the catalog's neutral base of 50. Because the entry is community-maintained, trust adjusts the score by -10. Declared high-risk capabilities add +10 (capped at +30). It matches no dangerous capability combinations. The clamped result is 50, placing it in the medium band.

See the full scoring formula →

Findings

  • Established community project Trust offset
    Contribution to score: -10
  • 1 high-risk capability: credentials:access High
    Contribution to score: +10

Capabilities

Every capability the entry declares, with the security implication of each.

  • filesystem:read Filesystem read
    Can read files on the host system. Used for context, indexing, or analysis.
  • network:outbound Outbound network
    Can make outbound network requests. Required for hosted model providers and remote APIs; also the path for data exfiltration if combined with read access.
  • credentials:access Credentials access
    Reads provider API keys, OAuth tokens, or other secrets from the host keychain or environment.