> For the complete documentation index, see [llms.txt](https://developer.eagle.cool/plugin-api/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.eagle.cool/plugin-api/plugin-review/criteria/file-safety.md).

# File Safety

Every plugin package undergoes a file-safety check. A plugin must not contain viruses, trojans, ransomware, spyware, undisclosed downloaders, or any other file that could harm users, Eagle data, or the operating system.

## What Is Checked

The submitted `.eagleplugin` and its contents are evaluated for known and suspicious threats, including:

* known malware and infected files;
* programs that download dangerous content after installation or launch;
* executable files unrelated to plugin functionality;
* replaced, compromised, or untrusted third-party components;
* dangerous content that is packaged or hidden so its behavior cannot be reasonably verified.

To complete the safety review, submitted plugin files may be processed by security services used by Eagle. Do not include private or confidential information that should not be submitted.

## Developers Are Responsible for Third-Party Components

Developers remain responsible for the final release even when a file comes from an open-source project, package manager, or another developer. Obtain dependencies from trusted sources, lock and inspect the actual release versions, and avoid copying unknown binaries into the package.

A clean safety result does not remove the need for source review, security updates, or dependency management. Developers must continue addressing newly discovered vulnerabilities and compromised components after publication.

## If a Dangerous File Is Found

When a file is confirmed to present an unacceptable safety risk, the current submission does not proceed to human review. The developer should:

1. Remove the dangerous file and every related reference.
2. Determine its source, purpose, and how it entered the project.
3. Obtain or rebuild the component from trusted source code or a trusted release.
4. Check whether the development environment or other dependencies were also affected.
5. Create a fresh release directory and `.eagleplugin`; do not reuse old build output.
6. Revoke and rotate any credential that may have been exposed.

Renaming, recompressing, or hiding the file does not resolve the issue. A resubmitted package receives a complete safety check again.

## Common Reasons a Submission Does Not Pass

* The package contains a confirmed virus, trojan, or other malware.
* An unsafe executable unrelated to functionality or from an unexplained source is included.
* The plugin downloads and runs unverified external content.
* A resubmission reuses previously compromised build output.

When a file has not been proven dangerous but its behavior, source, or necessity requires context, it may receive further review under [Security and Privacy](/plugin-api/plugin-review/criteria/security-and-privacy.md) or [Package Contents](/plugin-api/plugin-review/criteria/package-contents.md).