From @edsummersnc:
Consider refactoring the list of approved plugins into a JSON file or similar file type. Include npm package name, description, and repo. This will allow users of the scanner to find third-party plugins, perform their own security review, file issues on those plugins, contribute fixes, fork/extend, etc.
The allowlist is currently maintained in the repo's codebase, as it contains only a single entry.
From @edsummersnc:
The allowlist is currently maintained in the repo's codebase, as it contains only a single entry.