AI lets anyone build a Revit add-in, an AutoLISP routine or a Maya script in minutes. CertiPlug audits each one for security, code health, version compatibility and ISO-aligned governance before it reaches your drawings.
Three recent Autodesk cases show what happens when plugins, scripts and scene files go unchecked.
A self-copying worm hid inside Maya scene files sold on Epic's Fab marketplace. 39 sellers uploaded infected assets without knowing. Opening one file rewrote Maya's startup script and spread to every scene saved after it. The marketplace scanner did not catch it.
Source: AV-Comparatives ↗Ransomware was reported using .dwg and .dwt extensions to pass as ordinary drawings, the files engineers open all day without a second look. Checking extensions alone is not enough; content has to be inspected.
Source: ITPro via Pulse ↗Revit 2025 moved its API to .NET 8, so add-ins built for earlier versions must be recompiled. In-house tools that nobody owns tend to break during upgrades, or keep running with errors on live models.
Source: Autodesk Developer Blog ↗Add AI to the picture: anyone in a design office can now generate a plugin in minutes. Most are never reviewed, never versioned, and have no owner once the author leaves.
Each audit returns one trust score built from four dimensions, with every finding explained in plain language and linked to the fix.
Upload the plugin or connect its repository. We read .addin, .dll, .lsp/.fas/.vlx, .py, .mel and Dynamo graphs.
Static and behavioral analysis runs in an isolated sandbox. The AI flags what the code does, not just what it says.
A security engineer confirms every high-risk finding, so you are never blocked by a false alarm.
You get the trust score, an ISO-mapped report, and the CertiPlug mark for plugins that pass.
Every new plugin version or Autodesk release triggers a re-check, so the mark stays true.
AI wrote much of the plugin code we see. AI also helps us audit it at scale, with a human engineer signing off every critical verdict.
# certiplug scan scene_tools.py --target maya ✓ parsed 412 lines · python 3 ! base64 blob decoded → executes at import ✗ writes to userSetup.py (startup hook) ✗ copies itself into opened .mb / .ma scenes ✗ behaviour matches self-replicating worm → verdict: BLOCKED score 18/100 → ISO/IEC 27001 A.8.7 protection against malware
Understands what a routine actually does to files, the registry and the network, even when the code is obfuscated.
Every issue comes with a short explanation and a suggested fix your developers or BIM team can act on.
Reviews plugins that call AI models for prompt injection, data leakage and over-broad permissions.
Matches every bundled library against known vulnerabilities and alerts you when a new one is published.
Every CertiPlug finding is tied to a recognised international control, so your report can serve as evidence in your organisation's own certification and surveillance audits.
| Standard | Scope | What CertiPlug checks against it |
|---|---|---|
| ISO/IEC 27001:2022 | Information security management | Annex A controls for secure coding (A.8.28), malware protection (A.8.7), technical vulnerabilities (A.8.8), change management (A.8.32) and asset inventory (A.5.9). |
| ISO/IEC 27034 | Application security | Security requirements and verification built into how each plugin is developed and released. |
| ISO/IEC 25010:2023 | Software product quality | Reliability, maintainability, compatibility and security characteristics that make up the health score. |
| ISO/IEC 5055 | Automated source code quality | Measurable code weaknesses in reliability, security, performance and maintainability. |
| ISO/IEC 42001:2023 | AI management systems | Oversight, accountability and risk controls for plugins that are AI-generated or that call AI models. |
ISO-aligned audits, audit-ready evidence. CertiPlug audits plugins against controls drawn from these standards and produces evidence for your ISO programme. ISO certification itself is issued only by accredited certification bodies; CertiPlug helps you arrive at that audit prepared.
Design and engineering firms run more custom plugins than almost any other industry. That is where CertiPlug begins.
See every plugin running on your workstations, with a risk score and an evidence trail for your ISO auditor.
Approve tools for your teams with confidence, and know which ones will break before the next Revit upgrade.
Earn the CertiPlug mark and show clients your add-in has been independently checked.
Screen submitted plugins and assets for hidden scripts before buyers download them.
Every customer gets a secure company workspace. Upload a plugin, get its trust score in seconds, and request a certificate your clients can verify online.
Adds people, sets each user's role and permissions, and sees every scan and certificate.
Adds and manages members, but cannot change admins or give rights they do not hold.
Works with exactly the permissions the admin gives: run scans, see team results, request certificates.
Our team approves certificates and manages company accounts, including suspending or blocking access.
No. CertiPlug audits plugins against controls taken from ISO/IEC 27001, 27034, 25010, 5055 and 42001, and gives you evidence you can use in your own certification audit. Certificates are issued only by accredited certification bodies.
Plugins are analysed in an isolated environment and are not used to train AI models. For sensitive tools, an on-premise scanning option is planned for enterprise customers.
Yes. Compiled .dll and .fas/.vlx files are analysed for their behavior and structure. Source code, where available, allows a deeper health score.
Monitored plugins are re-checked against the new release, and you are alerted to any compatibility break before your teams upgrade.
No. CertiPlug is an independent service. Autodesk product names are used only to describe compatibility.
We are onboarding a small group of design and engineering firms for pilot audits. Send us the plugins your teams depend on, and we will return a full trust report.