Hari If I install a flarum extension will extension author get acess to my site? Can they copy my website's user data? Or Can they perform bulk delete operations?
As with all software - it's possible that there are malicious apps. Also in very tightly monitored ecosystems like Apple iOS malicious apps have slipped through the reviews. And this is a platform where there are all apps reviewed.
While extensions are not reviewed for Flarum, most of them are OpenSource. With availability to the source code, it's at least easily possible to be checked for malicious code. Also, a greater number of users will be monitoring.
If you are suspicious I'd recommend only install extensions from trustworthy sources. For example well-respected members of this community. And of course you can always report something here if you have concerns.
Hari Like we have security plugins in WordPress** do we have any extensions in flarum?
There is not. It would need to be a very good piece of extension to detect malicious extensions.
Hari Should I just use audit log? To see all delete actions ?
While audit log gives you insight into what is happening in your community it won't protect you from malicious extensions. If someone really develops a malicious extension able to implement a backdoor to take over your community it surely can also circumvent the audit log from showing something.
I think the risk of having a malicious extension is far less than having the community compromised due to a leaked password or a security problem with the hosting setup.
