Plugin ecosystems protect you in three different ways: isolation that limits what code can do, declared permissions you approve, and review that checks code before it is listed. Many rely mostly on review. Knowing which one you are relying on tells you how much checking you must add yourself.
The three models
1. Isolation. The platform runs the plugin in a restricted environment and enforces limits. Atlassian's Forge documentation describes apps running in isolated runtimes with an outbound proxy that enforces declared egress domains, and says apps cannot access users' login credentials or sessions.
2. Declared permissions. The plugin states what it needs, and you or an admin approve it. Atlassian says a new version cannot raise scopes, permissions or egress domains without site admin reapproval. Microsoft Teams lets admins allow or block apps and limit them to groups.
3. Review and policy. A team checks plugins and removes bad ones, but approved plugins run with the host's access. The Visual Studio Code documentation says the extension host has the same permissions as VS Code itself, with Marketplace malware scanning, signing and a block list as protections. Obsidian says it cannot reliably restrict plugins to specific permissions, so plugins inherit its access, and it scans every version and shows a safety scorecard. WordPress.org guidelines set rules and reserve the right to disable plugins or change them for public safety.
Side by side
| Property | Isolation | Declared permissions | Review and policy |
|---|---|---|---|
| What limits damage | The runtime | The approved scope | The listing gate and removal |
| Who decides access | The platform | You or an admin | Nobody per plugin; it inherits |
| Cost of a malicious update | Bounded by runtime and scopes | Bounded by approved scopes | Full host access |
| What you must still check | Scopes, egress and vendor backend | Whether the approval is right | Everything about the plugin |
| Example from the sources above | Forge | Forge scopes, Teams policies | VS Code, Obsidian, WordPress.org |
Real ecosystems mix the models. Forge uses isolation and declared permissions together. Teams adds certification information to its allow decisions.
What each model asks of you
With isolation, read the scopes and the egress list. Those are the real boundary. Confirm the vendor's own backend, which sits outside the platform's limits.
With declared permissions, approve narrowly. A permission you grant because the prompt was annoying is a hole you built yourself. Treat any scope increase as a new review.
With review only, assume the plugin can do whatever your user can do. Then decide: is the plugin worth that? Limit the host with separate profiles, separate machines for sensitive work and allowlists. See what can a VS Code extension access and Obsidian community plugins.
Choosing between ecosystems
If you can pick the platform for a new capability, prefer the one with the strongest technical limits for the same function. If you cannot pick, set your expectations by the model: more isolation means lighter per plugin review, and review only means a heavier one.
For a way to run that review, see a 60 minute security design review of a plugin ecosystem.
Common mistakes
- Treating a marketplace listing as a security approval.
- Counting a badge as isolation. A badge is a signal about the vendor.
- Ignoring update behavior. Isolation and permissions help only if updates cannot silently widen them.
- Forgetting the removal path.
Safeguard works on the software you build: dependency scanning, reachability analysis, policies and gates, and an MCP Guardrail for AI tool use. The principle is the same as above, which is to limit what any one component can do.
Quick check
Is a reviewed marketplace the same as a sandboxed one?
No. Review checks code before listing. A sandbox limits what code can do at run time. Several ecosystems document review without a sandbox.
Which model needs the most work from my team?
Review only ecosystems, because installed plugins inherit the host's access and you must do the limiting yourself.
Sources
- Extension runtime security, Visual Studio Code documentation
- Security for Forge apps on the Atlassian Marketplace
- Plugin security, Obsidian Help (source text)
- Detailed plugin guidelines, WordPress Developer Resources
- Manage your apps in the Microsoft Teams admin center
Last reviewed: 19 October 2026.
