Please report vulnerabilities privately through GitHub Security Advisories for this repository. Do not open a public issue containing exploit details, tokens, personal data, or a proof of concept that targets users.

Include the extension ID and version, affected Campus version, requested resources, reproduction steps using non-sensitive fixtures, and the impact you believe is possible. FlutterFlow will acknowledge the report, coordinate a fix, and withdraw affected releases when necessary.

Git history and SHA-256 content addressing establish which accepted bytes a client received. They do not make extension code harmless. Once a user grants a raw process, native helper, full filesystem resource, unrestricted HTTP resource, or raw secret, the extension can exercise that authority without a prompt on every call. A child process runs with the current user's OS authority; the host cannot honestly enforce an exact filesystem or network-origin boundary inside arbitrary child code.

Registry tooling must never execute package code during validation or client installation. Publication may run maintainer-approved build steps only after merge in a trusted job, with signing secrets unavailable to pull-request jobs.

Published artifacts and releases are immutable. Incident response uses a new fixed release, release withdrawal, and—if repository integrity is affected—an official Campus update that changes or revokes the configured source. History must not be rewritten to hide a compromised artifact.