4 articles tagged Security.
A tool that fetches any URL a stranger types is an attack surface before it is anything else. How the plugin checker finds plugins from outside a site, and the layers that keep it from being pointed inward.
MCP turned agent integration from custom glue into a standard. It also turned your API keys into something an email can reach. Both are true.
Most API breaches are not clever. They are an endpoint that returned an object without checking who was asking. Here is the full list, and what to do about each one.
The code is the easy part. The reason plugins get rejected is almost always something small, avoidable, and documented in a handbook nobody read.
