Security

A plug-in is code, and it runs whenever a script that uses it solves. NodePen keeps that code with the team that uploaded it.

Your plug-ins stay with your team

• Only your team's admins can add one. Uploading, enabling, disabling and removing plug-ins needs a team admin — signed in to NodePen, or through an API token they minted with the plugin:write scope. A token without that scope can't, nor can anyone else's token, whatever its scopes. Connected agents can't do any of it.
• Only your team's scripts can use them. Another team never sees your plug-ins in its component library, and its scripts are never solved with them, even if they name one of your components.
• Nothing runs until you enable it. A new upload is loaded once to check it, and nothing else runs it until an admin turns it on.
• Turning one off takes effect on your next solve. A disabled or removed plug-in is never handed to another of your team's jobs.
• Your files stay private. Uploaded plug-ins are stored where no browser can download them, not even yours. Another team that uploads the same file gets its own plug-in, which runs only for its own scripts.

Where your plug-ins run

• Work with your plug-ins will only ever run on machines scoped to your team. The same goes for every solve your team runs, with plug-ins or without: another team's work never runs on a machine your team's work has run on, and yours never runs on theirs.
• Those machines can only reach what the job in hand needs. Each solve can read and write only the files it was given, through links that expire within 15 minutes. They hold no credentials for NodePen's database, or for any other team's files.
• Machines don't last. One retires after 10 minutes without work, after 2 hours at most, and whenever a plug-in it has loaded is disabled or removed. Its replacement starts clean.
• What runs is what you uploaded. Each plug-in is checked against the fingerprint taken when it was uploaded, every time it is loaded, and refused if it does not match.
• A .zip is unpacked with care. Nothing in it can be written outside its own folder, and an archive that unpacks too large or holds too many files is refused.

What this does not cover

A plug-in runs alongside your team's own work, so it can see what your team's solves handle: your scripts, models and results. Upload plug-ins from authors you trust, as you would install them on your own computer.