This plugin is published under an all-rights-reserved license rather than a public repository, which is a reasonable thing to want to verify before approving it â especially given it makes an outbound network connection. This page exists so a reviewer can read the actual source directly instead of taking the listing on faith. It isn't linked from anywhere else on the site.
The plugin never opens an inbound port. It dials out only to the relay URL the server owner
themselves configures in config.yml â never an address it chooses on its own.
Staff web credentials are PBKDF2-hashed with a random salt, stored locally on the server
that owns them, and never transmitted or logged in plaintext. Full detail is in the source
itself, not just this summary.