Check O11 · execution surface family · severity CRITICAL · automatic · one of the 17 Open VSX checks
Maps to OWASP LLM03 Open VSX's own review status and deprecation are platform states, not techniques; its silence is not a clearance.
The question this check asks: what does Open VSX itself say about this version? The record carries a reviewStatus (published, under review or rejected) with a message, and a deprecated flag with the replacement's name.
The registry's own word is the cheapest signal there is, and RepoGates reads it. But Open VSX's own scan results are admin-only: the public signal is the review status, and on an ordinary published version that field is absent. Its silence is never read as a clearance — it only means none of the rows below is written.
A rejected version is ovsx-review:rejected, CRITICAL, 25 points, and the verdict is BLOCK, with Open VSX's message beside it. A version still under review is ovsx-review:under_review, HIGH and 10 points, and the verdict is cached for a short time so it is read again soon. Any other status that is not published is HIGH too. A deprecated extension is ovsx-deprecated, MEDIUM and 4 points, with the replacement named. These are the default weights; the scoring table has no row of its own for the Open VSX checks yet.
All 100 of the most-downloaded extensions measured on 1 November 2026 are published, and none is deprecated; O11 fired on none.
Open VSX's scan results. They are admin-only and not published. Why Open VSX rejected a version, beyond its message. Earlier versions: the latest version's status is the one read. A published status is not a clearance.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. Open VSX is the registry VSCodium, Cursor and Windsurf install from. An extension there is assessed on request: through the API (/v1/ovsx/score/{namespace}/{extension}), the MCP server (platform="ovsx") and the preflight, which reads an open-vsx.org address and a codium, vscodium, cursor or windsurf --install-extension line. That line is read against both Open VSX and the VS Code Marketplace, because it cannot show which registry the editor uses; code --install-extension stays the Marketplace's. An extension installed from the editor's own UI, or one that auto-updates, is not a shell line the hook sees; there is no board on Open VSX's pages, and the browser's download gate does not read open-vsx.org. This roster reads what Open VSX publishes about an extension — its record, its version history, its manifest, the package's file list and at most eight agent files inside the package — and the extension's code bundle is not read on this tier. Open VSX's own scan results are admin-only and not published; its review status is evidence, and its silence is never a pass. An extension Open VSX no longer serves is not assessed, never a pass. A PASS means nothing matched on what was read.
curl -s https://open-vsx.org/api/NAMESPACE/EXTENSION | jq '{reviewStatus, reviewMessage, deprecated, replacement}'On an ordinary published version the review fields are absent; that is not a review.
Does a published status mean Open VSX reviewed the extension? No. On an ordinary published version the review field is absent, and its silence is never read as a pass. Open VSX's own scan results are admin-only.
What happens to a rejected version? It is a critical finding and the verdict is BLOCK, with Open VSX's message shown.
Is a deprecated extension blocked? No. It is a medium finding with the replacement named, so you can move to it.
V11 Marketplace validation — what the Marketplace says, read the same way · H6 Hub malware scan hit — another registry's own word, read as evidence.
Add RepoGates to Chrome Pricing
Sources for this page: Open VSX's published record format, read on 1 November 2026; the measurement of Open VSX's 100 most-downloaded extensions the same day; the severities from the product's roster, and the default weights of its scoring table; campaign facts as the primary write-ups state them. See also the Open VSX intelligence page.