Project security

Open a project from unknown sources

When you open a project that was created outside WebStorm and was imported into it, WebStorm displays a dialog where you can decide how to handle this project with unfamiliar source code.

You can select one of the following actions:

• Preview in Safe Mode: in this case WebStorm opens a project in a "preview mode" meaning you can browse the project's sources, but there are restrictions in executing any tasks or scripts or running/debugging your project.

  WebStorm displays a notification on top of the editor area, and you can click the Trust project link and load your project at any time.

• Trust Project: in this case, WebStorm opens and loads a project. That means project is initialized, project's plugins are resolved, dependencies are added, and all WebStorm features are available.

• Don't Open: in this case WebStorm cancels the action.

Startup tasks

When you open a project created on a different machine, it might contain some scripts or tasks that are executed during the opening process. If such tasks are found, WebStorm displays a notification suggesting that the code you are about to execute might be harmful.

You can review what tasks will be executed and modify the settings.

Safe mode preview limitations

If you open a project in the safe mode, the following limitations will apply to the project:

• Startup tasks: any scripts or tasks that are executed during the opening process are disabled.

• VCS support: the whole VCS support is disabled.

• File Watchers scripts will not be executed.

• npm, pnpm, and yarn scripts will not be executed.

Trusted locations

You can configure what sources WebStorm should consider safe and accordingly load them and run File Watchers or webpack configurations without showing the notification.

You can add your home directory to the trusted locations to disable WebStorm's warnings about untrusted projects.