Security and Trust

Security and plugin trust

The latest stable MoleditPy 5 release receives security fixes. Historical version tags support reproducibility and are not maintained. See SECURITY.md for private reporting and scope.

Plugins execute Python with the same user permissions as MoleditPy and are not sandboxed. They can access files, launch programs and communicate over the network. Review the publisher and source before installing them.

Plugin Installer SHA-256 verification checks downloaded bytes against the registry record. It is not a security audit or publisher authentication. Optional MCP/HTTP/SSH integrations also have their own binding, access-control and credential-handling surfaces; report issues to their owning plugin repository.

Do not publish vulnerability details in public issues or include private calculation data or credentials. Report privately with the app, plugin, Python, Qt/RDKit/VTK and OS versions and a minimal reproduction.