# \#security

**URL:** https://discourse.joplinapp.org/tag/security/97.md

[Latest](https://discourse.joplinapp.org/latest.md) · [Categories](https://discourse.joplinapp.org/categories.md) · [Tags](https://discourse.joplinapp.org/tags.md)

---

## [Desktop v3.6.3 pre-release: Plugin API breaking change](https://discourse.joplinapp.org/t/desktop-v3-6-3-pre-release-plugin-api-breaking-change/48928)

<div class="topic-metadata">

**Author:** [@personalizedrefriger](https://discourse.joplinapp.org/u/personalizedrefriger)\
**Replies:** 0\
**Last updated:** [2 March 2026 19:14 UTC](https://discourse.joplinapp.org/t/desktop-v3-6-3-pre-release-plugin-api-breaking-change/48928 "2026-03-02T19:14:20Z")

</div>

Overview To improve security, the v3.6.3 pre-release strengthened the desktop app's Content-Security-Policy. As a result, inline event handlers and script blocks are now blocked in most plugin WebViews. Plugins that rel…