Security audit

Security audit

Permissions, data, and dependency security checks.

Scope

Are permissions minimal and necessary?
Command injection, SQL injection, path traversal
Sensitive data logging or uploading
Known high-risk dependency vulnerabilities
Secure key and token storage

Requirements

Do not read user data unrelated to the feature
Inform users before uploading data
Restrict outbound requests by domain and protocol
Never log secrets, tokens, or phone numbers

Process

Submit → automated/manual checks → feedback → fix → re-review. Plugins cannot be listed until they pass.

Up next