It is a common practice to provide CI/CD processes secrets as environment variables. For example, take the GitHub Actions docs sample:

steps:
  - shell: pwsh
    env:
      SUPER_SECRET: ${{ secrets.SuperSecret }}
    run: |
example-command "$env:SUPER_SECRET"

Now suppose I want to debug this example-command locally, using my own SuperSecret (for example this could be my personal access token to some service). I would have to add something like this to launch.json :

"type": "PowerShell",
//...
"env": {
  "SUPER_SECRET": "MY_REALTOKEN_SERCET"
}

This is not ideal, considering my actual secret token is now stored in plaintext on my hard drive - which most likely isn't even encrypted. This can be easily solved by an extension, using the SecretStorage API, and indeed one such extension has been created to address this exact concern: https://marketplace.visualstudio.com/items?itemName=pomdtr.secrets&ssr=false .
The problem is, I'm not going to hand over all my secrets to an extension with a total of ~1,200 installs, one (4-star) review, and 4 GitHub stars - in my book it makes the cure more dangerous than the illness, and I'd rather take my chances with hackers gaining access to my hard drive. Don't get me wrong, the dev looks like a great guy, but I'd need a stronger guarantee for something like this...
The issue here is trust, especially in such a sensitive topic. Perhaps you could work with said extension's developer (@pomdtr) in order to integrate it into the VSCode codebase? I'd reckon this a very common scenario that could benefit from a very easy security gain...