Patched open source Capacitor
Security maintenance for Capacitor, shipped like a product
Capacitor+ is an automated fork of Capacitor maintained by Capgo. It tracks upstream, merges community fixes faster, and publishes npm packages under @capacitor-plus while security work stays visible in the repo.
- Drop-in @capacitor-plus packages with the same Capacitor API
- Daily upstream sync with CI and manual review on conflict-prone changes
- Public security notes in the capacitor-plus repo
- Links to Capgo researcher docs and GitHub security advisories
What you get with Capacitor+
Think of Capacitor+ as supported open source for your native runtime. You stay close to ionic-team/capacitor, but you are not stuck waiting on a single upstream queue when a security fix or stuck PR matters for production.
Patched fork on npm
Install @capacitor-plus/core, @capacitor-plus/cli, @capacitor-plus/android, and @capacitor-plus/ios. Capgo publishes from the plus branch after CI and review.
Security checks on upstream sync
Every upstream sync pull request is reviewed for command injection, path traversal, hardcoded secrets, breaking API changes, stability issues, data safety, and suspicious code.
Transparent security notes
The repo includes SECURITY_AUDIT_CLI.md, a public CLI audit with severity-tagged findings. Capgo also publishes GitHub security advisories for its own products.
Upstream coordination
Capgo lands fixes on Capacitor+ first when that is the fastest path for customers, then opens pull requests on ionic-team/capacitor when the change belongs upstream.
Review checklist on every upstream sync
The capacitor-plus README lists what reviewers look for before a sync merges. Upstream sync pull requests require manual review and are not automatically merged.
See the Review Expectations table in the Capacitor+ README .
- Security: injection, traversal, secrets, XSS
- Breaking changes: API removals and signature changes
- Stability: null checks, exceptions, races
- Data safety: privacy and insecure storage
- Code integrity: obfuscation and suspicious network calls
Documented CLI audit findings
SECURITY_AUDIT_CLI.md in Cap-go/capacitor-plus lists six exploitable CLI issues with file and line references. Treat it as the public record of known risk areas Capgo tracks in the fork.
The capacitor-plus README does not list CVE IDs today. This table reflects documented audit findings, not a guarantee that every row is already fixed in npm.
| Severity | Finding | Source |
|---|---|---|
| HIGH | Arbitrary command execution via hook scripts | SECURITY_AUDIT_CLI.md |
| HIGH | Path traversal in Cordova plugin asset copying | SECURITY_AUDIT_CLI.md |
| MEDIUM | XML injection in generated config files | SECURITY_AUDIT_CLI.md |
| MEDIUM | Unvalidated platform path configuration enables arbitrary directory operations | SECURITY_AUDIT_CLI.md |
| MEDIUM | Symlink following in web asset copy | SECURITY_AUDIT_CLI.md |
| LOW-MEDIUM | Gradle flavor injection in build arguments | SECURITY_AUDIT_CLI.md |
The audit shipped in merged pull request #104 .