There is no sandboxing at all. Every plugin has full access to your computer.

Is there auto-updating of plug-ins?

Installing a plug-in and reviewing its code at that point is one thing. But if the plug-in can be updated withut you knowing, then there’s little guarantee of security.

	▲	kepano 39 minutes ago \| parent [-]
		You can automatically check for updates but it's off by default, and still requires a manual click. Also the new plugin review system automatically scans every release.