How do I know if a non-official plugin is legit, and won't do somehting bad?

[Retired Miner]

I am not and was never an IT professional, a hobbyist in retirement is a good description.

I saw posts (on reddit) about an interesting plugin named os-loupe. What it claims to do is very interesting: Loupe records which device talked to which site name and how much, what was the Device X doing at 2 a.m.? 

It is not listed on the plugins list. You have to run two fetch commands from the console to make it appear as a plugin, the fetches come from github. 

This is where I am 100% lost, if something is not an official plugin how do you know if it can be trusted?

The GitHub webpages look nice and polished (in fact, a little too slick and too polished). They mention AI in quite a few places, which to me is a red flag.  Realistically I don't know what I am looking at in GitHub, or what to look for, under all the source code, docs, workflows, tests and tools.  There could be a few lines of code buried deep in there that send everything to the dark web and I wouldn't know it.

[franco]

> This is where I am 100% lost, if something is not an official plugin how do you know if it can be trusted?

I think this is the core problem: we cannot by default.  That's why we started the community plugins so that we can have review, discussion and bugfix capabilities.  But this was over a decade ago.  Nowadays with AI assisted large blobs of code we can no longer screen submissions for official plugin inclusion.  People just tend to publish it privately anyway because it beats going through a review process (it works, right?!). Whether that's with the source code open or not doesn't really matter; for one you can read the source code in the install archive and secondly there's still a lot of code to sift through which is just unlikely to be looked at by a human.

The other issue we see is that plugins were mainly meant to accommodate a (known) third party software for integration.  Now the world is being reimplemented in Python scripts in a heartbeat so you don't even have that trust boundary anymore.  Naturally, we don't really like to see these in the plugins because it puts the full maintenance load on the project once it has been accepted, which it can't be because it's not battle proven in the first place.

And, yes, it looks very pretty: code style, documentation, websites, communication.  It is slowly becoming a red flag in this day and age.

FWIW, that's only my opinion.  There's good things in this, but it still takes (human) effort to curate if this is something to be shared with the community.  Otherwise everyone will just have to write their own plugins for themselves with the help of AI.  This would be a bleak future.  ;)


Cheers,
Franco

[Greelan]

we can no longer screen submissions for official plugin inclusion

Sounds like the review process is not available anyway?

[franco]

> Sounds like the review process is not available anyway?

Why not check the facts at https://github.com/opnsense/plugins/pulse?period=monthly

October 6, 2026 – November 6, 2026

52 Active pull requests
96 Active issues
32 Merged pull requests
20 Open pull requests
66 Closed issues
30 New issues

Excluding merges, 30 authors have pushed 75 commits to master and 101 commits to all branches.

On master, 148 files have changed and there have been 3,776 additions and 962 deletions

Cheers,
Franco