Question 1

Who is MDL Shield for?

Accepted Answer

Moodle plugin developers who want independent security assurance for their code. Whether you maintain a free community plugin or a commercial product, MDL Shield helps you find and fix vulnerabilities before they're exploited.

Question 2

How do I get started?

Accepted Answer

Sign up, verify that you're the maintainer of your plugin, and run your first review from your dashboard. We already track every plugin in the Moodle plugin directory, so for listed plugins there's nothing to upload. To review a private plugin, or one that isn't listed, connect your own Git repository instead.

Question 3

What Moodle versions do you support?

Accepted Answer

We support all currently maintained Moodle versions. We can review plugins targeting older versions by request, but we'll recommend upgrade paths where relevant.

Question 4

What do I get in a review report?

Accepted Answer

Developer-friendly reports with specific file paths, line numbers, code snippets showing the issue, severity ratings, and clear fix guidance. No vague "improve security" recommendations: we show you exactly what to change and why.

Question 5

Can you review a version before I release it?

Accepted Answer

Yes. Pre-release reviews let you review an unreleased version, such as a development branch or tag, before it goes public, so you can find and fix issues before your users ever see them.

Question 6

How long does a review take?

Accepted Answer

Most reviews finish within minutes. You don't need to wait around: we email you as soon as the report is ready.

Question 7

Can I export a review?

Accepted Answer

Yes. Every completed review has an Export menu: copy the full report as clean Markdown, download it as a .md file, or hand it to your AI assistant with instructions to work through each finding.

Question 8

What is the security badge?

Accepted Answer

Published reviews earn a security grade badge you can display on the Moodle plugin directory, your Git repository, or your own website. The badge shows your plugin's current security grade and links back to your latest published review.

Question 9

Can I review a private plugin, or one that isn't in the Moodle directory?

Accepted Answer

Yes. As well as plugins in the Moodle directory, you can connect your own Git repository and review any plugin, including private repositories and code that isn't listed on moodle.org. Public repositories connect directly; private ones use a read-only deploy key you add to your repo. Repository reviews use a paid review credit.

Question 10

Which Git hosts are supported?

Accepted Answer

All of them. Public repositories connect directly by URL; private ones use a read-only deploy key you add to your repo. GitHub, GitLab (including self-managed), Bitbucket, or your own Git server: if it speaks Git, we can review it.

Question 11

Is my private code kept confidential?

Accepted Answer

Yes. Your code is cloned only to run the review, then deleted as soon as it finishes. We never store a copy of your source.

Question 12

How do you verify plugin ownership?

Accepted Answer

If your plugin is hosted on GitHub and your GitHub username matches the repository owner, verification is instant. For collaborators and other maintainers we offer several methods: a GitHub Issue a maintainer approves with a single checkbox, a verification code in a .mdlshield file in your repo, or a verification code on your plugin's moodle.org directory page. We also support manual verification by our team for special cases.

Question 13

Is it really free for open source plugins?

Accepted Answer

Yes. Non-commercial plugins listed in the Moodle plugins directory keep their free monthly reviews: no trial periods, no strings attached. We believe every Moodle plugin developer should have access to security tooling regardless of budget.

Question 14

How do you determine if a plugin is commercial?

Accepted Answer

We analyse the plugin's source code for indicators of commercial licensing or payment requirements.

Question 15

How do review credits work?

Accepted Answer

Credits cover the reviews the free tier does not: repository reviews, pre-release reviews, and commercial plugins. One credit per review, bought in packs. See the pricing page for the packs.

Question 16

Can I get proper business invoices?

Accepted Answer

Yes. Add your business name, address, and tax ID at checkout or in your billing settings, and they appear on your invoices and receipts.

Question 17

Who can see my review results?

Accepted Answer

Only you, until you decide otherwise. Review results are private by default; publishing a review (and earning its badge) is always your choice.

Question 18

Is MDL Shield affiliated with Moodle?

Accepted Answer

No. Moodle is a trademark of Moodle Pty Ltd. MDL Shield is an independent service and is not affiliated with or endorsed by Moodle Pty Ltd.

Frequently asked questions

Getting started

Reviews & reports

Repositories & private code

Ownership & verification

Billing & credits

Trust & data