BApp Store acceptance criteria - Port Swigger
Summary: PortSwigger published acceptance criteria for extensions submitted to its BApp Store, stating that all BApps are reviewed for security and quality before a decision on inclusion. The criteria require extensions to avoid duplicating existing BApps, treat HTTP message content as untrusted, bundle all dependencies, release resources via Extension.registerUnloadingHandler() on unload, and use Burp AI as the default provider for any AI functionality.
What's compelling: The criteria assume users may be testing sites they don't trust, so an extension that mishandles HTTP message content exposes those users to attack - and AI extensions are pushed through Burp Suite's platform rather than third-party API keys so all AI traffic stays in one place.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026