EmDash 1.0 separates plugin publishing from its central catalog

EmDash 1.0 is an open-source CMS built on Astro, with a plugin registry that uses AT Protocol records for publishing releases. Publisher accounts own those records, while a catalog can moderate what it lists. Plugins run in sandboxes and request additional access explicitly, separating plugin discovery, release verification and permissions instead of treating them as one trusted operation.

Cloudflare · Sep 28, 2026

Why it matters

The registry design offers a useful example of separating publishing authority from discovery.

More context

Try the MIT-licensed CMS in a staging project and review each plugin’s requested access. The registry checks release records and package integrity; only free plugins are supported at launch, with paid distribution planned.

Keep in mind

The 1.0 release does not make every plugin safe. Sandboxing and verification are documented mechanisms, not a security audit by 1min; paid plugin support is future work.

Original read