Deliberately deferred: plugin allowlist with hash pinning (#232). The hard off-switch (#200) in M25 already closes the 'code execution in the VS zone' risk for the offer stage.
alt
click/enter
