From Sandbox to Review Queue: My GSoC 2026 Project with OWASP OWTF

When I started GSoC in May, my plan was to build a runtime sandbox for community plugins. By week two my mentor had talked me out of it, and I ended up spending the rest of the summer building a review queue instead. This post is about how that happened and what I actually shipped. Quick summary Project: Community Driven Plugin Ecosystem for OWTF Org: OWASP Foundation Mentors: Abraham Aranguren, Viyat Bhalodia What got shipped: Six pull requests against owtf/owtf , around 6,000 lines of Python and TypeScript, 153 backend unit tests, and a trust model doc. Working mirror of this post: gist If you only want the code, here are all my PRs on OWTF . The problem I was trying to solve OWTF is a security testing framework, and until this summer its plugin catalogue was static. If you wrote a detection for some new attack pattern, your options were: open a PR against the framework itself (high bar, slow), or keep the plugin to yourself. Most useful plugins never made it upstream because of that. The Community Plugin Marketplace fixes this. Any authenticated user can upload a Python plugin through the web UI. The plugin is validated at upload time, lands in a pending queue, and waits for an admin to look at the source. Once approved, the plugin gets mirrored into OWTF's standard plugin table. From that point on, the runner, the worklist, and the report generator all treat it exactly like a built-in plugin. The pivot My accepted proposal called for a sandbox. Community plugins would run inside something like a subprocess with dropped privileges, so that a malicious plugin could not do too much damage. Then Viyat said this in Slack: A sandbox in Python that talks to the same postgres, the same file system, the same target scope as OWTF itself is not really a security boundary. I sat with that for a couple of days and realised he was right. A plugin that runs inside OWTF has to see the target, has to read config, has to write results. Any "sandbox" I put around that is going to