Continue

US CLOUD Act exposureOpen sourceApache-2.0

Homepage ↗Repository ↗

USAGE ON STAV · LAST 12 WEEKS

Where Continue shows up on Stav.

Live usage rolls up every five minutes. We surface the 12-week trend once enough requests have flowed through this app.

STAV REVIEW · LAST REVIEWED 06/21/2026

“Inference never touches Continue's servers, but a June 2026 acquisition by Cursor has frozen the codebase at v2.0.0 with no confirmed security-patch owner.”

Good for

Teams running fully self-hosted or air-gapped LLM backends who need a battle-tested, Apache-2.0-licensed IDE extension without vendor lock-in
Organisations that want to connect VS Code to a Stav-managed endpoint today, knowing the extension's BYO-provider architecture keeps code off third-party infrastructure
Enterprises willing to fork and maintain the now-frozen codebase, given its permissive licence and 34,200-star community base
Teams evaluating open-source AI coding tools who want a large, auditable reference implementation before committing to an actively developed successor

Watch out for

The GitHub repository is read-only post-acquisition and v2.0.0 is the final release from Continue Dev, Inc. — no security patches, dependency updates, or bug fixes are expected from the original team, leaving forward-looking supply-chain risk unowned
Cursor's plans for ongoing maintenance, the commercial SSO tier, and post-acquisition telemetry policy have not been publicly confirmed; the existing privacy policy predates the acquisition and may not reflect how Cursor handles data going forward
Both Continue Dev, Inc. and acquirer Cursor are US-incorporated entities, confirming CLOUD Act exposure; no DPA or SOC 2 attestation has been identified, which is a blocking gap for regulated-sector approval
Any future Cursor-published successor extension should be treated as an unassessed app — it may route Inference through Cursor's own infrastructure rather than preserving the current local-only data flow

Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.

MODEL REQUIREMENTS

What Continue needs from a model.

Required

Streaming

Recommended

Code-native
Long context (≥128k)
Tool calling

Known issues8 open

Public security, privacy and governance advisories that are still open. Each row carries a source link — these are factual claims, not editorial judgements.

2026-06-30

lowUpstream change on continue: github_last_push '2026-06-23T05:12:13Z' → '2026-06-29T09:42:06Z'

other · open

Source ↗

2026-06-23

lowUpstream change on continue: github_release 'v1.2.24-vscode' → 'v2.0.0-vscode', github_last_push '2026-06-16T05:48:45Z' → '2026-06-23T05:12:13Z'

other · open

Source ↗

2026-06-16

lowUpstream change on continue: github_release 'v1.2.22-vscode' → 'v1.2.24-vscode', github_last_push '2026-06-08T23:46:38Z' → '2026-06-16T05:48:45Z'

other · open

Source ↗

2026-06-09

lowUpstream change on continue: github_last_push '2026-06-01T21:46:42Z' → '2026-06-08T23:46:38Z'

other · open

Source ↗

2026-06-02

lowUpstream change on continue: github_last_push '2026-05-18T18:06:15Z' → '2026-06-01T21:46:42Z'

other · open

Continue

Where Continue shows up on Stav.

What Continue needs from a model.

Data flow

Telemetry

Security profile

Maintenance health

Popularity

What teams using Continue configure.