Storage and filesystem

Store private plugin data below an extension-owned directory such as:

data/plugins/<plugin-key>/

Do not place credentials, drafts, queues, source imports, or private records under public/. Public files should be delivered through a validated route or through an approved core media service.

Use stable record identifiers. Validate every user-supplied slug, filename, and path segment before resolving a path. Reject traversal, absolute paths, symbolic links, and records that escape the intended base directory.

Write complete files atomically and use a stable lock when concurrent web or CLI updates are possible. Do not replace damaged authoritative data with an empty default. Report the error and preserve the original bytes for recovery.

Use the core content, draft, media, user, configuration, date, and export services when they own the data. Do not infer storage paths or edit their files directly.

Document whether plugin data appears in author export, site backup, static export, or none of them. Disabling a plugin does not remove its data. Provide an explicit removal procedure when stored records or files need cleanup.