Modrinth-plus/docs/security-review.md

Security Review

Scope

Project:

Modrinth Plus

Reviewed version or commit:

main

Code Patterns Checked

• No eval.
• No dynamic Function constructor.
• No unsafe HTML injection.
• No unexpected shell execution.
• External network calls documented for Connected Library.
• No private Connected Library credentials are persisted in v1.
• Connected Library requires HTTPS manifest and .mrpack URLs.

Dependency Review

Command:

pnpm --filter @modrinth/app-frontend run lint
cargo clippy --package theseus

Result:

Pending successful Gitea Actions run.

Runtime Review

• Connected Library manifests are stored locally in SQLite.
• Connected Library auto-update is disabled by default.
• GITEA_TOKEN is only for local agent API checks, not runtime app use.
• Full Tauri runtime permission review pending.

Release Notes

Known residual risks:

Connected Library update behavior is conservative and does not yet implement strict removed-file sync.