Safety and signatures

Safety and signatures

Sandbox

Each plugin is a small WebAssembly program in a strict sandbox. It has no raw network access and no direct file access. Mumcord draws its interface from built-in building blocks.

Permissions you can see

Listed before install. Optional ones can be turned off any time. Updates that need more wait for your approval. See Permissions explained.

Signed

• The registry index and every package are signed (minisign).
• Mumcord checks size, hash, author signature and manifest before installing.
• A kill switch can turn off a bad version everywhere.

Reviewed

New plugins, new author keys and new permissions need one maintainer approval and green automated checks: schema check, reproducible rebuild, author signature, permission diff, load test and licence scan. Plugins must use an OSI-approved licence and contain no ads, tracking, payments or loot boxes.

No server changes

Plugins work against an unmodified Mumble server. People on the official Mumble client are not affected.