Security

Plugins are not sandboxed. The embedded JVM and class loader isolation are not a security boundary, and a plugin has the same operating system rights as the server. Only install plugins you trust.

Limits on asynchronous work restrict framework work. They do not restrict arbitrary allocations, threads or operating system access.

For plugin developers

• Keep secrets out of your JAR and out of config.yml defaults.
• Treat player input as untrusted. Use typed command arguments where possible.
• Stop your own threads in onDisable.
• Do not keep native views across sessions. Store UUIDs instead.

Marketplace

Every upload to the Zernyth Marketplace is validated, held in quarantine, scanned and reviewed before it is published. A clean scan means no known malware signature matched. It is not proof that a plugin is safe.

Configuration handling

YAML is read without aliases, JSON keys are checked for duplicates, and files are limited to 1 MiB. Files are written with atomic renames. Protection against an attacker with the same operating system rights is not promised.