[otikik]

So I have been thinking about this for a while - if your product has "plugins" there's only two ways forward:

* There's a line of "blessed plugins" that your own company supports, maintains and guarantees, and everything else is considered "not trusted" or

* Plugins have explicit permissions - like phone apps do. "This plugin can make external calls/write to the filesystem inside a dedicated folder/read and set cookies". And then you are in charge of enforcing that with the strongest sandbox you can make.

Plugin ecosystems without these rules are just the wild west.