# Week\_2 : Coding period - Progress Report

**URL:** <https://discourse.joplinapp.org/t/week-2-coding-period-progress-report/50104>\
**Category:** Plugin Ecosystem Security\
**Created:** [5 June 2026 14:06 UTC](https://discourse.joplinapp.org/t/week-2-coding-period-progress-report/50104 "2026-06-05T14:06:59Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![akshajrawat](https://yyz2.discourse-cdn.com/flex028/user_avatar/discourse.joplinapp.org/akshajrawat/32/28106_2.png) [@akshajrawat](https://discourse.joplinapp.org/u/akshajrawat)\
**Post date:** [5 June 2026 14:06 UTC](https://discourse.joplinapp.org/t/week-2-coding-period-progress-report/50104/1 "2026-06-05T14:06:59Z")

</div>

### **PROGRESS :**

This week was full of tests and coding. I raised my first pr for the local validation for the new cli publish pipeline for plugins : [All: Resolves #15595: Added local validations for new publish workflow for plugin ecosystem by akshajrawat · Pull Request #15596 · laurent22/joplin · GitHub](https://github.com/laurent22/joplin/pull/15596)

Furthermore,  
I ran many tests on `codeql` , `semgrep` ,`socket dev` and made a deep flow based threat model for SAST and SCA scanning. Here is a deep study of all the tools : [Plugin Security Tool Comparison -- CodeQL, Semgrep & Gemini CLI](https://discourse.joplinapp.org/t/plugin-security-tool-comparison-codeql-semgrep-gemini-cli/50049)

I completed the structure code for the scanning CI for the plugin repository and made it working : [[Plugin Submission] joplin-plugin-test v1.0.0 · Issue #4 · akshajrawat/plugins-test · GitHub](https://github.com/akshajrawat/plugins-test/issues/4#issuecomment-4628302660)

 ![Screenshot 2026-06-05 113640](https://canada1.discourse-cdn.com/flex028/uploads/cozic/original/3X/5/a/5a672c34b5ab89f8d2fe1b6b0c91ea9a1b71cdfa.png)

### **Next Week Scope**

- **Test & refine the threat model :** Continue doing more tests for SAST tools and figure out more attack vectors to flag in the threat model.

- **Refine the scanning pipeline :** Test all the edge cases of the scanning CI and refactor the code in more reusable and better way.

### **Problem Faced**

Tool testing and knowing what actually we have to test and we need is kinda hard.. though I'm figuring my way out of it !