ceebee wrote:

Browser-based extensions and userscripts can be risky because they can get access to everything you do online. This means that they could potentially get information about the websites you visit, collect private information about you, and change what you see in ways you don’t expect. In the past, we have allowed these to be advertised on Scratch because they can also be fun, safe, and helpful tools – and because we’ve seen that Scratchers can learn a lot by making them. But we feel the risks and potential harm outweigh these benefits.

infinitytec wrote:

• The Community Guidelines must be followed: if a userscript or extension violates the community guidelines, it cannot bee advertised. Links to it shall be removed.
  
• Userscripts and extensions must be open-source: that way the community and users can examine the code to determine its safety.
  
• No collecting and sharing of user data: extensions and userscripts must not make any data available to anyone.
  
• Local resources only: the userscript or extension must run completely on the user's computer. Servers are not to send or receive data with the userscript or extension. However, a server may be used to distribute the userscript or extension, as long as it is secure. For example: userscripts can be downloaded off of GitHub and extensions can be downloaded via the browser's official extension site.
  
• Transparency: users should know exactly what the userscript or extension does. The extension or userscript should have a forum thread that adequately describes what it does. While the userscript or extension is available, the forum thread must be open so issues can be reported. On closing the thread, all download links will be removed. When advertising the userscript or extension, any links for it must point to that forum thread and not an external website.
  
• Ultimately, the Scratch Team gets the final say. They can handle violations in the way that seems best based on the Community Guidelines and the userscript/extension security and distribution policy.
  

PullJosh wrote:

• Don't share scripts that result in any sharing of user data, even if it's opt-in. Many users – especially younger Scratchers – aren't aware of the full implications of safety decisions that they make, and could end up doing something that they don't mean to.
  
• Always make the source code for anything you share easily available. (This means no scripts that require a server/backend to run!) Everybody who wants the script should have easy access to every line of code involved, and should be encouraged to read it and look out for anything that would be of concern to them. Forum users should also check each other's scripts when possible to spot any security issues (intentional or not).
  
• Always, always, always respect what the ST says. They're doing difficult but important work running this site, and it's our job to make their lives easy.
  

NitroCipher wrote:

• Does not link to dangerous websites
  
• Follows community guidelines
  
• Submission request must include proper grammar and punctuation
  
• Discussion
  

(function() {
  var nav = document.querySelector("#topnav ul.site-nav, #navigation .inner>ul");
  var discuss = document.createElement("li");
  var discuss_a = discuss.appendChild( document.createElement('a') );
  discuss_a.setAttribute("href", "/discuss/");
  discuss_a.innerText = "Discuss";
  if (nav.className === "site-nav") {
      nav.insertBefore(discuss, nav.children[2]);
  } else {
      discuss.className = "link discuss";
      nav.insertBefore(discuss, nav.querySelector("li.tips"));
  }
})();

• Don't share scripts that result in any sharing of user data, even if it's opt-in. Many users – especially younger Scratchers – aren't aware of the full implications of safety decisions that they make, and could end up doing something that they don't mean to.
  
• Always make the source code for anything you share easily available. (This means no scripts that require a server/backend to run!) Everybody who wants the script should have easy access to every line of code involved, and should be encouraged to read it and look out for anything that would be of concern to them. Forum users should also check each other's scripts when possible to spot any security issues (intentional or not).
  
• Always, always, always respect what the ST says. They're doing difficult but important work running this site, and it's our job to make their lives easy.
  

PullJosh wrote:

-snip-

infinitytec wrote:

PullJosh wrote:

-snip-

Good thoughts! The no-backbone rule I think would be helpful to apply.

DeleteThisAcount wrote:

hmm I have problem with all of this.

i no trust scratch security SCRATCH TEAM MAKE ACRATCH OPEN SOUCE NOWWWWWWWWWWW or at least the 2.0 site. k the bub bye

• The Community Guidelines must be followed: if a userscript or extension violates the community guidelines, it cannot bee advertised. Links to it shall be removed.
  
• Userscripts and extensions must be open-source: that way the community and users can examine the code to determine its safety.
  
• No collecting and sharing of user data: extensions and userscripts must not make any data available to anyone.
  
• Local resources only: the userscript or extension must run completely on the user's computer. Servers are not to send or receive data with the userscript or extension. However, a server may be used to distribute the userscript or extension, as long as it is secure. For example: userscripts can be downloaded off of GitHub and extensions can be downloaded via the browser's official extension site.
  
• Transparency: users should know exactly what the userscript or extension does. The extension or userscript should have a forum thread that adequately describes what it does. While the userscript or extension is available, the forum thread must be open so issues can be reported. On closing the thread, all download links will be removed. When advertising the userscript or extension, any links for it must point to that forum thread and not an external website.
  
• Ultimately, the Scratch Team gets the final say. They can handle violations in the way that seems best based on the Community Guidelines and the userscript/extension security and distribution policy.
  

PullJosh wrote:

As I'm sure you're aware, Scratch 3.0 is fully open source, as well as a decent portion of the website's code.

infinitytec wrote:

I updated the OP to have some ideas that people have had that can be implemented.

MathWizz wrote:

-snip-

infinitytec wrote:

So this is what I think:

• The Community Guidelines must be followed: if a userscript or extension violates the community guidelines, it cannot bee advertised. Links to it shall be removed.
  
• Userscripts and extensions must be open-source: that way the community and users can examine the code to determine its safety.
  
• No collecting and sharing of user data: extensions and userscripts must not make any data available to anyone.
  
• Local resources only: the userscript or extension must run completely on the user's computer. Servers are not to send or receive data with the userscript or extension. However, a server may be used to distribute the userscript or extension, as long as it is secure. For example: userscripts can be downloaded off of GitHub and extensions can be downloaded via the browser's official extension site.
  
• Transparency: users should know exactly what the userscript or extension does. The extension or userscript should have a forum thread that adequately describes what it does. While the userscript or extension is available, the forum thread must be open so issues can be reported. On closing the thread, all download links will be removed. When advertising the userscript or extension, any links for it must point to that forum thread and not an external website.
  
• Ultimately, the Scratch Team gets the final say. They can handle violations in the way that seems best based on the Community Guidelines and the userscript/extension security and distribution policy.