Beta: needs approval. Mods are in beta: ask Lucra for access to install one.
Mods are built so that a mod can't break, restyle or impersonate Lucra, and can't reach anything that moves money or grants access.
What a mod can't do
- Ship markup or styles. A mod picks Lucra components and their props; class names, styles and anything that would place content outside the mod's area aren't offered.
- Speak as Lucra. Everything it shows sits under a label with its name; its messages carry its name; its error text never reaches a person.
- Send people anywhere. It can only open its own pages, never Settings, sign-out or another site.
- Load what it likes. Components that would fetch a URL a mod chose aren't offered; its server may reach only the hosts its
mod.jsonlists, besides the Lucra API. - Ask for credentials. Lucra refuses a form whose fields are named like passwords, tokens or card numbers.
- Touch money, access or messages directly. Payouts, billing, ad spend, sign-in, roles, keys and messages sent as people are sealed off from mods. A mod works through the Lucra API like any other app, with only the access it was installed with.
- Run unreviewed code.
mod buildrefuseseval,Functionand computed imports, and installs come from signed packages.
Limits
Lucra times out a mod that's slow to answer, can turn any mod off everywhere, and checks every tree before drawing it. A broken mod shows an error in its own area; the rest of Lucra keeps working.