Extender plugins

Extender loads your own detection rules into Studio as WebAssembly plugins — you're not limited to the built-in rule pack.

What a plugin is

A plugin is a .wasm module plus a sidecar .json manifest describing it (id, name, what it checks for). At runtime it implements the same passive-rule interface as Studio's built-in rules, so once loaded it's treated the same way: it runs automatically on captured exchanges, and any hits show up in Findings and the Coverage matrix alongside first-party results.

Loading a plugin

1. Open Extender.
2. Load the plugin's .wasm file (with its manifest alongside it).
3. It appears in the loaded-plugins list and starts running on new captures immediately.
4. Unload it the same way if you want to stop it — loaded plugins live for the current app session and aren't statically baked into the app, so removing one has no effect on the built-in rule pack.

Why WASM

Plugin code runs sandboxed inside a WebAssembly runtime rather than as native code with full access to your machine — a plugin can inspect the exchange it's given and emit findings, but it isn't a general-purpose way to run arbitrary code on your system. That's a deliberate boundary: custom detection logic, without expanding what a plugin is trusted to do.