Community Plugin - Security Hint and Quality Gate

[argentum]

@EleanorKonik

“I don’t necessarily feel able to commit to looking at things every 14 days, this isn’t my day job and I have kids, so I’m not going to submit, but if you guys want it, here’s the link to the github repo, you can install it via BRAT.”

I agree with this. I think we can’t reasonably expect that plugin devs provide support as if it was a full-time job. Most people in the community are creating and maintaining plugins as volunteers, on their free time, out of the goodness of their hearts and with the intention to help as many people as they can.

A developer agreement that includes this, once a dev has decided to stop maintaining a plugin, sounds reasonable to me:

@LarsKumbier

the pledge to inform Obsidian through a PR to the deprecation-list, if they are unable or unwilling to continue this work in the future, and

The remaining three points are good practices, and without the time pressure, would probably be adopted by plugin devs to the best of their abilities. I believe we will get a lot further if we kindly support these volunteers, so they can keep doing the great job that they are doing. These could be added to the PR template (strike-through and bold are my edits):

@LarsKumbier

• the pledge to include it is highly recommended that you set up automatic security checks for production dependencies through dependabot or a similar product, here is a guide on how to enable them,
• the pledge of the plugin developers to handle security issues within 14 days here is a guide on how to handle dependabot security alerts (either by closing unfitting PRs from dependabot or merging them),
• the pledge to continue this support for a grace period of at least 60 days, so that if you need help maintaining your plugin, here is a guide on how another maintainer can be found or the plugin can be deprecated and delisted, (e.g. by opening a specific issue type in the obsidian-releases repo).

Some server-side checks that inform users in the plugin store when was the last release, and whether there are any known dependency vulnerabilities for it sound reasonable to me.

As a user, you can also take up part of this work load and periodically review your plugins, e.g. Log in or sign up to secure your projects | Snyk or another scanner of your choice and of course opening PRs to solve such issues.