Trust & capabilities

Two independent mechanisms keep plugins safe: a trust tier that tells you where a plugin came from, and capabilities that limit what it can do.

Trust tiers

• Official — cryptographically signed and verified against the project key embedded in the app. Verified plugins carry an official badge so you can see at a glance that they’re genuine.
• Community — unsigned. They install behind a warning so the choice is deliberate.

The sandbox

Every plugin runs in an iframe sandbox, isolated from the rest of the app. It has no ambient access to your data or system.

Capability grants

At install time you’re shown the exact capability grants a plugin requests — the specific things it needs to do its job. You must approve them before the plugin is installed. A plugin can never do more than you’ve allowed, whatever its trust tier.