search

zielu / GitToolBox

GitToolBox IntelliJ plugin
GNU General Public License v3.0
605 stars 74 forks source link

Removing the source from github makes your plugin a security risk #468

Open javajosh opened 1 year ago

javajosh commented 1 year ago

Describe the bug You removed the source of your plugin from public view. This allows you to inject supply chain vulnerabilities into countless developer IDEs. It makes you a potential target for extortion by those who want to gain high-level access to a wide variety of systems. I really like this plugin, but I will be forced to a) remove the plugin and b) use your old sources to build a new plugin that I can be assured is not undermined.

To Reproduce Steps to reproduce the behavior:

  1. Go to github.
  2. Click on https://github.com/zielu/GitToolBox
  3. Scroll down to read about removing the source code.
  4. Realize the potential for abuse

Expected behavior plugin source remains public. Wiping your git history and taking the repo private is a warning sign.