---
id: plugin-ecosystem/third-party-plugin-sidecars-are-unconfined
title: "Third-party plugin sidecars are unconfined"
theme: plugin-ecosystem
status: open
created: 2026-08-18
date_source: section
order: 2
---

**Third-party plugin sidecars are unconfined.** A plugin sidecar runs `bun run <script>` with
`cwd: PLATFORM_DIR`, so Bun auto-loads `.env` and it gets `POSTGRES_URL`; it runs as the service
user, which owns `secrets/officer-keys.db` and can therefore mint an owner JWT. Fine for
first-party plugins, total compromise for anyone else's.

The mechanism to fix it already exists and is pointed elsewhere: `spawn-as-member.ts` drops
privileges with `setpriv --reset-env` and a six-name allowlist for exactly this reason.