Security

To start off with, all the code is MIT licensed & open source (Mods, SDKs, ...), so you're free to audit it yourself.

In the short term, we're building and selecting every Mod that goes into the public registry. All the Mods are open source and versioned through npm, and you're free to review the code yourself for any concerns, or before updating packages. We don't load new Mods or Mod updates over the wire.

In the long term, when there are many Mods, particularly community made ones, we will have a different system for labelling Mods that gives high trust and security guarantees, more akin to systems used by App stores, but in a decentralized manner.

There are also explorations of running Mods inside secure javascript execution environments, and Mod will in future support any such web standards that don't make sacrifices in performance or user experience.