1. What this marketplace is

This site is an index of third-party plugins for the PegaProx Proxmox VE and XCP-ng management platform. Each entry points at a public GitHub repository written and maintained by an independent developer who is not the PegaProx project.

2. What this marketplace is NOT

• Not a code review service. We do not audit plugin source.
• Not a guarantee of safety, quality, or fitness for any purpose.
• Not a vendor of the plugin code. Plugin downloads come directly from the author's GitHub repository.
• Not an endorsement by PegaProx of any plugin, its author, or its behaviour.

3. Admin approval ≠ security review

We approve plugin listings for the marketplace. That check covers metadata (does the repo exist? is the description accurate? is the category right?), not the contents of the plugin code. An approved listing does not mean the code is safe, bug-free, or free of malicious behaviour.

4. Plugins run with full server access

PegaProx plugins typically run inside the same process as PegaProx itself and have the same permissions: filesystem access, network calls, the ability to read your cluster credentials, execute commands on connected Proxmox / XCP-ng hosts, and more. A malicious plugin can:

• Read and exfiltrate cluster credentials, API tokens, SSH keys.
• Execute arbitrary commands on every node PegaProx manages.
• Delete or encrypt VMs, snapshots, and backups.
• Open backdoors that survive across PegaProx upgrades.

This is not theoretical. Treat plugin installation as you would treat running an unknown shell script as root.

5. Required workflow before installing

1. Read the source. Open the GitHub repo. Skim every file in the plugin.
2. Check the author. Pick plugins from developers with a public track record.
3. Pin a specific release. Don't git pull main — clone the tagged release the marketplace points at, so you know exactly what code you're running.
4. Diff after every update. Before pulling a new version, git diff <old-tag> <new-tag> and review every changed line. Treat new dependencies, new network calls, and new shell-outs with extra scrutiny.
5. Stage on a non-production cluster if you can. Run the plugin in a sandbox PegaProx instance with a throw-away dataset before pointing it at production.
6. Watch the audit log after install. PegaProx logs node-level actions — if a plugin starts doing things you didn't expect, that's where you'll see it first.

6. No liability

To the maximum extent permitted by applicable law, the operator of this marketplace and the PegaProx project disclaim all warranties and accept no liability whatsoever for damages arising from the installation, use, malfunction, or compromise of any plugin listed here, including (without limitation) direct, indirect, incidental, special, consequential, or punitive damages; loss of data, profits, revenue, business, or goodwill; damage to hardware, virtual machines, backups, or third-party systems; data exfiltration; ransomware; or any security incident caused by plugin code.

This disclaimer applies whether the claim is based on warranty, contract, tort (including negligence), or any other legal theory, and whether or not the operator has been advised of the possibility of such damage.

7. Plugin licensing

Each plugin is licensed by its author under whatever license they publish on GitHub. Read and comply with the licence before installing. The marketplace operator is not a party to the licence and grants no rights of its own to plugin code.

8. Reporting malicious plugins

If you find a plugin that appears malicious, broken, deceptive, or in breach of someone else's rights, email support@pegaprox.com with the plugin name and your evidence. We will review and, if appropriate, unlist the plugin. Unlisting from the marketplace does not remove the code from GitHub or from machines that already installed it — you remain responsible for cleaning up your own environment.

9. Acceptance

By browsing, downloading, or installing any plugin via this marketplace you confirm that you have read, understood, and accepted this disclaimer.

Last updated: September 2026