Security audit

Every plugin gets an automated scan of its code, dependencies, and permission requests. Scans are automated — they are not a manual review and never an endorsement. The scan is a first-class part of every artifact's record.

What we scan

Dependency vulnerabilities

Known CVEs in direct and transitive dependencies, from public vulnerability databases.

Suspicious permissions

Requests that reach outside the plugin's declared scope — fs.write, network.external, env access.

Hardcoded secrets

API keys, tokens, or credentials committed into the repository.

Supply chain risks

Unpinned dependencies, suspicious install scripts, or post-install hooks.

Risk levels

LowNo known vulnerabilities or suspicious findings.

MediumModerate findings — review the report before installing.

HighSignificant risks — we recommend against installing.

CriticalSevere vulnerabilities or secrets — do not install.

⏳ Pending status

1,360 artifacts currently show Security: Pending — the automated scanner is being integrated and will run nightly. Until then, "pending" means not yet scanned, not "safe". Install third-party plugins at your own risk.