Addon Security

[FlailAway]

The closing response to issue #28783

We of course don't control 3rd-party addons.

There are many dozens of add-ons listed under this "Freecad" Git heading..

Is that to mean you do not check them at all?

[PhoneDroid]

Addons are currently reviewed
before being added to the index.

Existing addons that were present
before the review process will be
reviewed one by one later on.

There are no regular checkup for
the specific purpose of security.

We do plan on scanning for CVEs in
the Addon Reports to allow us to
inform and or submit patches easier.

Malicious addons would currently be
detected by user report and removed
upon review.

Personally I'm all for improving the
security of the whole process but in
reality there are various constrains.

For one addons are just Python code
run on the user's system, so it can
do whatever Python can do.

While we do have an allowed-packages
list, malicious code could just be
included in the addon itself.

The other is manpower, even if we had
a large team, regularly re-reviewing
every addon isn't an easy task.

We are forced to go with the standard
registry model of user-reports only.

If you have any ideas on how to improve
this process in a realistic way, please
let me know.