# VS Code extension SUPPORT.md before review friction

> Publish a SUPPORT.md and keep the issue, repository, and license links healthy so the buyer can inspect your operating discipline before the first install prompt asks for trust.

- Canonical HTML: https://growth.iangoh.com/growth-ideas/vs-code-extension-support-md-before-review-friction/
- Source: [code.visualstudio.com](https://code.visualstudio.com/docs/configure/extensions/extension-runtime-security)
- GrowthDex source hub: [Visual Studio Code Docs: Extension Runtime Security](/sources/visual-studio-code-docs-extension-runtime-security-code-visualstudio-com/)
- Last checked: 2026-06-06T12:40:00Z
- Rarity: rare
- Budget: free
- Channels: Trust, Support, Marketplaces
- Stages: developer tools, support surface, publisher trust, issue routing
- Key metric: As of VS Code 1.97, first-time installs from third-party publishers prompt the user to confirm publisher trust.

## Why this can grow

VS Code now asks users to confirm trust when they install from a third-party publisher, which means a vague support path costs more than it used to. The runtime security guide tells users to inspect ratings, Q and A, issues, repository, and license before deciding an extension is reliable. The publishing docs tell authors to add SUPPORT.md. Put those together and the lesson is plain: support metadata is not housekeeping. It is part of the trust check that happens before the extension gets a chance to prove itself in the editor.

## Ian's take

From scaling consumer platforms across MENA and Southeast Asia, my default is to distrust growth work that only looks good in a slide. My bias is to treat this as a small market test first. Make the audience narrow, make the promise concrete, and let the first real response decide whether it deserves more work. I would run it small enough to learn quickly, then only scale the parts that real users repeat, save, reply to, or buy from. For this tactic, I would watch one clear growth signal before putting more time or budget behind it.

## Action plan

1. Define one narrow startup segment where vs code extension support.md before review friction can create a measurable lift.
2. Turn the tactic into one offer, page, campaign, or workflow for the Trust and Support channel.
3. Use the evidence from code.visualstudio.com to set the first version of the message, format, and audience.
4. Launch a small test for 7 to 14 days with one success metric: one measurable growth signal.
5. Review the result, keep the winning message, remove weak variants, and turn the learning into a repeatable growth playbook.

## Source-backed example

VS Code's publishing guide recommends adding SUPPORT.md to the extension root, and the runtime security guide says users should inspect Q and A, issues, repository, license, and publisher responsiveness before installing.

## Adjacent tactics in the same lane

- [VS Code extension README and CHANGELOG finish the detail page](/growth-ideas/vs-code-extension-readme-and-changelog-finish-the-detail-page/) - 2 shared channels, 1 shared stage
- [Shopify support doc links on listing before generic homepage handoff](/growth-ideas/shopify-support-doc-links-on-listing-before-generic-homepage-handoff/) - 2 shared channels
- [monday marketplace partner page with installs, ratings, and support](/growth-ideas/monday-marketplace-partner-page-with-installs-ratings-and-support/) - 2 shared channels
- [HubSpot agent tool scope only for the context you use](/growth-ideas/hubspot-agent-tool-scope-only-for-the-context-you-use/) - 2 shared channels

## Read GrowthDex essays

Browse the plain-English essay index at [GrowthDex Blog](/blog/).

## Related GrowthDex essays

- [The VS Code extension page should finish the trust check](/blog/the-vs-code-extension-page-should-finish-the-trust-check/) - marketplaces, SEO, brand trust

## Advisory

If you want help turning this into a working growth system, Ian Goh offers advisory at https://iangoh.com/advisory.