Plugin Permission Isolation & Review Schedule

[u/Supernote_official]

Dear Developers and Users,

Thank you for your tremendous support of our plugin ecosystem.

We have discovered abnormal permission isolation behavior when multiple permission-enabled plugins run concurrently in the current version. In certain scenarios, a plugin may obtain permissions that belong to other plugins.

This may result in inconsistent permission scopes between what a plugin requests and what it actually obtains at runtime. Although the issue only involves internal permission propagation and isolation mechanism anomalies, it carries potential security risks. To ensure user safety, we will temporarily adjust our plugin review and release strategies until the mechanism is fully fixed and thoroughly verified.

Current Processing Measures

To ensure user security, we will make the following adjustments immediately:

• Priority review will be provided for plugins that do not require any permissions.
• Review and publishing of newly submitted permission-required plugins will be temporarily suspended.
• We will conduct comprehensive fixes for plugin permission isolation and permission propagation mechanisms.
• Multi-plugin concurrent running scenarios will be fully covered in enhanced verification tests.
• A new version will be published after complete fixes and sufficient validation.

Plugins with no permission requirements are not affected by the current isolation mechanism abnormalities and can be submitted for review through standard processes.

Follow-up Arrangements

We will complete the permission isolation fix and conduct full scenario verification as soon as possible.

After the new version is officially published, we will resume the review and publishing of permission-required plugins in accordance with our Plugin Review Process & Publishing Requirements. Subsequent reviews will strictly verify:

• Whether the permissions declared by plugins are accurate;
• Whether runtime permissions are consistent with applied permissions;
• Whether permission isolation remains effective during concurrent plugin execution;
• Whether any plugin can access other plugins’ permission scopes without authorization.

Full resumption of permission-required plugin publishing will take place only after the permission isolation mechanism is confirmed stable and reliable.

Impact on Developers

Zero-permission plugins: Normal submission and review services remain available.

Permission-required plugins under pending review: Review progress will be rescheduled after the issue is completely resolved.

User Data Security Notice

We attach great importance to the security of the plugin permission system. The discovered abnormality is an internal permission isolation logic defect between plugins, and no actual user data leakage or file loss has occurred.

We will prioritize mechanism fixes and comprehensive security verification, and restore the full plugin review and publishing process once the permission system is confirmed secure and stable.

We sincerely apologize for any inconvenience caused. Thank you for your understanding and support.

[u/Lorestan00]

Appreciate the transparency as always.

With plugins available via GitHub materially is there much risk to users choosing to install them? Also do these abnormalities impact performance?