It’s worse than that. A user installs a completely safe plugin through a marketplace, the marketplace pins a vetted commit for the plugin, trusting it is safe and will stay safe. If the “safe” plugin’s repo is…
It’s worse than that. A user installs a completely safe plugin through a marketplace, the marketplace pins a vetted commit for the plugin, trusting it is safe and will stay safe. If the “safe” plugin’s repo is…