How to report a security‒vulnerable plugin registered in the Marketplace?
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 358
- Forks
- 470
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 7
Description
The title says it. I obviously can't disclose the plugin name and the nature of the vulnerability publicly, but the plugin should be pulled off the Marketplace until the issue is resolved, and active users warned. What is the security contact for the Marketplace?
Other "marketplaces" (VS Code/VS plugins, browser extensions, Google Workplace extensions, you name it) have a Report button, and reports are always promptly acted upon with due diligence. Hint, hint. :-)
X-Ref: ‘Add the security “Report Plugin” button in Marketplace’, logseq discussion board
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked Logseq discussion, then review the Marketplace repository structure for any existing security-report or plugin-removal entry point. The issue names no file or test; the work would need a decided reporting path or documented security contact, with a clear process for handling reports and warning affected users.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100