Publishers and plugin trust

Plugins execute code inside Core. Publishers & Trust separates the project's official signatures from community publisher keys and your local consent.

Review a candidate

1. Open Publishers & Trust from the Editor or Core Settings. The manager may request its own API access.
2. Inspect the plugin ID/version, signature, publisher-key fingerprint and declared capabilities.
3. Allow the exact signed package, or trust the publisher key within the reviewed capability set, only when you intend to run that code.
4. Use Block or Revoke when you do not want the candidate or an existing grant to run.

An official signature is checked against the project's pinned key. A community signature proves possession of its publisher key; a displayed name alone does not establish identity or official status.

Changes and revocation

A different key or additional capabilities requires renewed consent. Exact-package approval does not authorize arbitrary future package contents. Existing publisher-name trust from the monolith is not imported.

Revocation denies new plugin work and begins cancellation/shutdown. If plugin code does not stop cooperatively, Core reports that a restart is required. In-process plugins are not an operating-system sandbox.

Different approvals

Approving an update source authorizes package delivery from that source. Pairing a client authorizes API scopes. Neither automatically authorizes a plugin to execute.

Current Core policy blocks unsigned or invalid plugin packages. Do not use historical instructions to disable signature enforcement. See Plugin author security.