Security and compatibility

Admin actions that change state require authentication, server-side authorization, and CSRF validation. Check author ownership as well as role permissions. Browser-side validation can improve the form but cannot replace these checks.

Escape template output unless it has passed through the approved Markdown or HTML sanitization path. Validate uploads by content, size, and intended use. Remote requests must reject unsupported schemes, embedded credentials, private-network destinations, unsafe redirects, and oversized responses.

Do not log passwords, tokens, private source documents, or complete request bodies. Keep secret and private responses out of shared caches.

The documented theme manifest, required views, view data, settings, screen-mode behavior, and plugin slots are supported 1.x theme interfaces. The documented plugin manifest, bootstrap callable, registration methods, bounded services, hooks, slots, and request helpers are supported 1.x plugin interfaces.

Internal classes, controller details, direct storage access, copied admin templates, first-party DOM structure, and CSS selectors are not compatibility promises. Review an extension on every update if it uses them.

A planned incompatible change to a supported 1.x interface should be announced for at least one minor release before removal. Extension manifests should declare an accurate tinymash compatibility range.