Security audit
- Are permissions minimal and necessary?
- Command injection, SQL injection, path traversal
- Sensitive data logging or uploading
- Known high-risk dependency vulnerabilities
- Secure key and token storage
Requirements
Section titled “Requirements”- Do not read user data unrelated to the feature
- Inform users before uploading data
- Restrict outbound requests by domain and protocol
- Never log secrets, tokens, or phone numbers
Process
Section titled “Process”Submit → automated/manual checks → feedback → fix → re-review. Plugins cannot be listed until they pass.