Plugin security and cleanup

Plugins are trusted JavaScript running in the embedding page. The public API limits coupling to application internals; it is not a security sandbox.

Treat browser data as public

Do not place these values in plugin code or options:

• API secrets or credentials
• Private customer data
• Server-only configuration
• Unpublished pricing tables that must remain confidential
• Tokens with write access to another service

Use a customer-owned backend when an integration requires authenticated server work.

Keep the base configurator resilient

• Use required: false for optional behavior.
• Perform fallible work inside setup() so failures can be attributed to the plugin.
• Return cleanup for every owned resource.
• Validate remote responses before using them.
• Use safe DOM properties such as textContent for dynamic copy.
• Avoid innerHTML for plugin options or remote data.

Stay inside the public boundary

Depend only on the public SDK. Do not import private application code or inspect and modify internal rendered markup. Use events, hooks, commands, outlets, landing sections, campaigns, and modals instead.

Treat public context objects as read-only. Hooks may return new transformed values where documented.