Resource scoping enforced

Passing the full host application instance to plugins — the Express app object, a raw database connection, or process — is functionally equivalent to giving every third-party plugin full administrative access to the application. Plugins can add routes, read or overwrite shared state, escalate their own permissions, or access data belonging to other plugins and tenants. OWASP A01 (Broken Access Control) and CWE-284 apply directly. The plugin surface becomes an attack surface: a malicious or compromised plugin can exfiltrate any data the host can reach.

Replace full-instance passing with a scoped PluginContext that exposes only the APIs plugins legitimately need. Define the interface explicitly so the accessible surface is auditable.

interface PluginContext {
  // Storage scoped to this plugin:
  storage: PluginStorage;
  // Only specific host APIs exposed:
  hooks: HookRegistry;
  config: Readonly<PluginConfig>;
  logger: Logger;
  // No access to: database, raw HTTP server, other plugins, internal state
}