Source form is easier to trust because you can read it and build it yourself. Precompiled form is common and often fine, but you are trusting the publisher's build, so you need provenance checks instead of code review. Unity supports both for native plug-ins, so the choice is usually yours to ask for.
What Unity says about plug-in forms
Unity's native plug-ins page says native plug-ins are libraries of unmanaged code written in languages such as C, C++ and Objective-C, which let managed C# code call functions from them. It says you can use both precompiled libraries and source code files as plug-ins, and that when you use source code, Unity compiles and links the plug-in code statically.
So the same functionality can arrive as a binary file you place in the project, or as source your project builds. The page also describes DllImport as the way to tell the scripting runtime where to find an unmanaged function, which is a useful search term when you audit a project.
Comparison
| Question | Source form | Precompiled form |
|---|---|---|
| Can you read what it does | Yes | Not directly |
| Can you rebuild and compare | Yes, with the toolchain | Only if the publisher documents the build |
| Who controls the build | You | The publisher |
| Effort to update | Merge a diff, review changes | Replace a file, trust the new one |
| Typical use | Small helper libraries, open source | Commercial SDKs, platform middleware |
| Review method | Code review and tests | Provenance, hashes, runtime behavior testing |
When binaries are your only option
Many commercial SDKs ship only as binaries. That is normal. It changes the checks:
- Get the file from the publisher's official channel and record the version and a hash of the file.
- Ask the publisher what the library does on the network, what data it collects, and what permissions it needs on each platform.
- Ask whether they publish a software bill of materials or a list of bundled third party libraries.
- Test it in a scratch build with network capture on, and note which hosts it contacts.
- Ask how they handle security reports and how fast they ship fixes.
- Record all of the above in your plugin register with an owner.
If a publisher cannot answer basic questions, that is information too. The post on what to do when a vendor goes quiet covers the follow up.
When to push for source
Push for source, or an escrow arrangement, when the plugin touches payment, accounts, user data or anything you could not replace in a week. For low stakes visual helpers, a binary from a reputable publisher with a clear update history is a reasonable risk.
Keeping it manageable
You do not need to read every library. You need to know which ones you have, where they came from, and who updates them. Our guide to inventorying native plugins in a Unity project gives a way to find the binaries first.
Safeguard's SBOM and dependency scanning covers declared packages and libraries, and you can try a free scan at gold.safeguard.sh/scan. Binaries dropped into a Plugins folder need the manual register entries above.
Quick check
Does Unity compile source plug-ins into the game?
Unity's page says that when you use source code as a plug-in, Unity compiles and links it statically.
Is a precompiled plugin automatically unsafe?
No. It means you rely on provenance and testing instead of reading the code.
What is DllImport for?
Unity says it tells the scripting runtime where to find an unmanaged function in a native plug-in.
Sources
Last reviewed: 19 October 2026.
