A plugin with a Source folder is compiled as part of your project build, and its Build.cs file is C# code that the Unreal build system reads. So a code plugin is not just content. It is third-party code in your build, and it deserves a review like any dependency.
What Epic's documentation says
Epic's plugin documentation says plugins with code have a Source folder with module source code. Plugins with code also have a Binaries folder with compiled code, and temporary build files go in an Intermediate folder. The page adds that any plugins with Source folders, containing .Build.cs files, will automatically be compiled by Unreal Build Tool when compiling your game project.
Epic's page on modules adds that the Unreal build system builds projects according to Target.cs files in the project and Build.cs files in modules, not according to the IDE solution files. Inside a Build.cs file you define your module as a class inherited from ModuleRules.
That is C# source code, one file per module, checked by the build tool. The build-tool page on targets says Unreal Build Tool compiles a .target.cs file and constructs the class inside it to read its settings.
What this means in practice
A third-party plugin brings several kinds of material:
| Part | Where | Review question |
|---|---|---|
| Module source | Source folder | Who wrote it and what does it call? |
| Build rules | Build.cs files | Does it reference external paths or libraries? |
| Compiled code | Binaries folder | Can the vendor tell you how it was built? |
| Content | Content folder | Does it contain scripts or blueprints you need to review? |
| Descriptor | .uplugin file | Which modules load, and on which platforms? |
Epic also notes that plugins are not required to contain code, so some are only content. Check which kind you have.
A vetting routine
- Read the .uplugin descriptor and list the modules it loads.
- Open each Build.cs. Look for external library references and unusual build steps.
- For a plugin shipped with prebuilt binaries only, ask the vendor for the source or a reproducible build description. If neither exists, record that as an accepted risk and who accepted it.
- Keep the plugin version, source and review date in your inventory.
- Rebuild from source in CI instead of relying on a binary built on someone's laptop where you can.
For the broader inventory habit, see the guide to engines, middleware and asset packs.
Common questions from studios
A frequent worry is that a plugin from a marketplace is already vetted. Epic's documentation describes how plugins are structured and compiled, and says nothing that turns a listing into a security review, so keep your own review step. Another is that prebuilt binaries are safer because nothing compiles on your machine. They are not, they are simply less visible: you cannot read what you cannot see.
A third question is who should read Build.cs files. A programmer who knows C# is the right person, and the review takes minutes per plugin once you know what to look for.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through the inventory and look at how each component is listed with a version and source. Your plugin list should read the same way.
Quick check
Are all Unreal plugins code?
No. Epic's documentation says plugins often contain code but it is not a requirement.
Who compiles a plugin with a Source folder?
Per Epic's documentation, Unreal Build Tool automatically compiles plugins with Source folders when it compiles your game project.
Sources
- Plugins in Unreal Engine, Epic documentation
- Unreal Engine Modules, Epic documentation
- Unreal Engine Build Tool Target Reference, Epic documentation
Last reviewed: 19 October 2026.
