@lubos, I understand the benefit of keeping Manager’s core lean and allowing extensions to handle country-specific or specialized functionality. In principle, that is a good direction.
However, I think @Patch raised the central concern and more important challenge: the issue is not only whether extensions are useful, but what the trust model is.
If third parties can create and maintain extensions, there needs to be a clear trust model around review, hosting, permissions, updates, and accountability.
Once an extension is visible or recommended inside Manager, users will naturally assume it has passed some level of review. That matters especially for accounting software, because the data may include invoices, tax records, bank transactions, customers, suppliers, payroll-related information, and years of business history.
Other ecosystems have already shown the risk. WordPress plugins, npm packages, browser extensions, and IDE marketplaces have all had cases involving vulnerable plugins, maintainer takeovers, compromised publishers, or malicious updates. This does not mean Manager has the same problem today, but it shows why extension systems need governance.
There is also a practical quality-control issue. I tried the Nigeria extension and the Setup button does not work in my installation. See screenshot.
That may be a simple bug, but it raises the question of how extensions are tested before listing, and how bugs, regressions, unsupported extensions, and security concerns are handled afterwards.
Also how does one uninstall an extension, what happens to the data and database config?
Extensions should also be scoped to individual businesses, not globally across the whole installation. A user may have Australian, Nigerian, American, and Pakistani businesses in the same Manager installation, each with different tax logic, reports, and compliance rules.
I also think extensions need proper management: developer details, purpose, permissions, data touched, version history, last update, support contact, enable/disable per business, uninstall, problem reporting, and an explanation of what happens to extension-created data if the extension is removed.
I say this because I genuinely like Manager. But the more Manager relies on extensions, the more important vetting, isolation, permissions, update control, and support responsibility become.