gitea has had some organizational problems so a lot of people have been using forgejo instead, which is just a community fork of gitea plus some more features

well the language server plugins all run a binary language server out of sandbox so zed doesn’t really do anything safer in particular there either. no ide has solutions, solutions don’t really exist right now. it’s not a problem of features of the language as much as it is features developers expect in extensions. I suppose there is a hypothetical “the extension wants to make this change to this file, approve” type flow like AI tools have now, but that sounds unpleasant to use. it still doesn’t get around things like language servers being designed to run as standalone processes out of sandbox.

by audits I meant you individually go and read all the code of all the extensions you use. of course that’s impossible too, but that was my point

I can’t imagine a sandbox would help. what can an an extension do that doesn’t touch some arbitrary code that gets run? it could add a line to the middle of a giant file right before you run and remove it immediately after. even if you run the whole editor in a sandbox you do eventually deploy that code somewhere, it can change something inconspicuous like a url in a dependency file that might not get caught in a pr

the only solution is to audit everything you install, know all the code you run, etc. ofc that’s not reasonable, but idk what else there is. better automated virus check things maybe? identity verification for extension publishers? idk if there’s an actual solution