A dashboard you can actually change
Every module is a plugin, including the ones we wrote. That is not a slogan: it is the same interface, the same permission checks and the same install button for our calendar as for anybody else's.
How a third-party plugin is kept at arm's length
A plugin store is a way of inviting other people's code near your calendar. These are the four things that stop that being reckless.
It cannot see your session
Third-party plugins render in a sandboxed frame with no same-origin access. No cookie, no token, and no way to call the API directly. Everything it does goes through a message channel the dashboard controls.
It must ask, by name
A plugin declares the permissions it needs in its manifest, and they are listed on the button you press to install it. Without contacts:read it cannot read your contacts — not as a matter of policy, but because the request is refused.
It is read before it is published
Submitted code is uploaded to a quarantined area and is never executed there. It is hashed, checked automatically, then read by a person, and only then does the bundle become fetchable at all. Review lowers the risk; it does not remove it.
It can be switched off
Removing a plugin cuts its access immediately. If a published plugin turns out to be a problem it can be disabled for everyone at once, and its bundle, its sandbox and its API calls all stop together.
What a plugin can ask for
Scoped by module and by direction, so read-only is genuinely read-only.
- calendar:read and calendar:write
- todos:read and todos:write
- contacts:read and contacts:write
- habits:read and habits:write
- notes:read and notes:write
- storage — a private store no other plugin can see
- network — only to hosts it declared up front
Sensitive by default
Anything touching money or the address book is flagged in the install dialog rather than listed quietly among the rest. You should have to think for a second before granting it.
Browse what is available
The Store lives inside the dashboard, at the bottom of the navigation bar.