Revit and Civil 3D plugin security: how to protect your C# add-ins
Secure C# plugins for Revit and Civil 3D: libraries, .NET 8 losing patches on Nov 10, 2026, code signing, the Unsigned Add-In prompt and trusted paths.
Security · Revit · Civil 3D · C#
A plugin runs with your permissions inside Revit and Civil 3D. Here's how to protect it
The six real risks of a C# add-in, the date coming up (.NET 8 stops getting patches on November 10, 2026), what the Unsigned Add-In prompt means, and how we handle it at Zeist.
Can a Revit or Civil 3D plugin have vulnerabilities?
Yes. A plugin runs inside the program with the same permissions as your user: it opens, changes and saves models and files. If it has a flaw, the flaw has that same reach. The risk concentrates in six places:
| Risk | What happens | How it's handled |
|---|---|---|
| Libraries with known flaws | An outdated library carries its flaw into the plugin | Check them with NuGet Audit before every release |
| Unsupported .NET | Microsoft stops shipping patches | Build for the .NET version of each release |
| Unsigned plugin or installer | Nobody can verify who made it or whether it was tampered with | Sign the DLLs and the installer |
| Open folders | AutoCAD and Civil 3D load code from anywhere | SECURELOAD at 1 or 2, plus trusted paths |
| Passwords in the code | Anyone with the DLL can read them | Keep them outside the plugin |
| Unvalidated outside data | A malformed Excel or CSV file changes the model | Validate it before touching the model |
What changes on November 10, 2026?
Support for .NET 8 and .NET 9 ends that day: Microsoft stops shipping security patches. Revit, AutoCAD and Civil 3D 2025 and 2026 load plugins on .NET 8. The 2027 releases use .NET 10, supported through November 2028.
Plugins keep working, but the platform underneath stops getting patches. The sensible plan: keep Windows and .NET updated until then, plan the move to the 2027 releases, and rebuild and test your plugins for .NET 10.
What does "Security – Unsigned Add-In" mean in Revit?
Revit shows that prompt at startup when a plugin isn't signed with a certificate from a trusted authority. It offers three choices: always load it, load it just this once, or don't load it.
Don't pick "always load" if you don't know who made the plugin. A signed plugin identifies its author and shows nobody changed it after it was published.
What about AutoCAD and Civil 3D?
AutoCAD and Civil 3D decide which programs to load with the SECURELOAD system variable. At 1, the default, they warn when a file comes from a folder that isn't trusted. At 2, they only load from the folders in TRUSTEDPATHS. At 0 they load anything without asking, which Autodesk doesn't recommend. Keep it at 1 or 2 and install plugins only in trusted folders.
How do we handle it at Zeist?
Every plugin we build ships with:
- Libraries checked with NuGet Audit before every delivery.
- The right .NET for each release: we build and test it for every new Revit and Civil 3D release, including the move to .NET 10 in the 2027 releases.
- Code signing on the DLLs and the installer, so Revit doesn't show the unsigned add-in prompt.
- No passwords in the code, and HTTPS-only connections when the plugin talks to a server.
- Validated data before anything touches the model.
- You own the source code, with documentation: if a library turns out to have a flaw, it gets fixed without depending on a closed product.
Sources
- Microsoft: .NET 8 and .NET 9 end of support on November 10, 2026.
- Microsoft Learn: auditing NuGet packages.
- Autodesk: digitally signing your Revit add-in.
- Autodesk: the SECURELOAD system variable.
Facts verified on October 21, 2026.
Related resources
- October's news: PHP2Shell, is your Revit or Civil 3D plugin at risk?.
- How a plugin gets built: Revit and Civil 3D add-in development, the complete guide.
- Your first C# plugin: Civil 3D API in C#, getting started.
- To budget for it: how much a Revit or Civil 3D add-in costs.
Frequently asked questions about plugin security
Do Revit plugins stop working when .NET 8 support ends?
No. They keep working, but from November 10, 2026 Microsoft stops shipping security patches for .NET 8, the platform plugins run on in Revit, AutoCAD and Civil 3D 2025 and 2026. The 2027 releases use .NET 10, supported through November 2028.
Why does Revit show "Security – Unsigned Add-In"?
Because the plugin isn't signed with a certificate from a trusted authority. Revit lets you always load it, load it just once or not load it. If you don't know who made the plugin, don't choose always load: a signed plugin identifies its author and shows nobody changed it.
What SECURELOAD value should AutoCAD and Civil 3D use?
1 or 2. At 1, the default, the program warns before loading a file from a folder that isn't trusted; at 2 it only loads from the folders in TRUSTEDPATHS. At 0 it loads anything without asking, which Autodesk doesn't recommend.
How do I know if a plugin uses vulnerable libraries?
With NuGet Audit, which checks the project's packages at build time and raises warnings NU1901 to NU1904 when one has a known vulnerability. In projects targeting .NET 10 it also checks indirect dependencies. The dotnet list package --vulnerable command lists them too.
Who can review and maintain my plugins' security?
At Zeist we build C# plugins for Revit and Civil 3D and maintain them: we check their libraries, build them for every release of the program and of .NET, sign them, and your firm owns the source code. The diagnosis is free and takes one week.
Keep reading on this topic
Revit and Civil 3D Add-in Development: The Complete Guide (2026)
The complete guide to Revit and Civil 3D add-in development: what add-ins are, what to automate, C# and the Autodesk API, deployment and cost.
How to Build a Civil 3D Plugin with Claude Code Without Being a Programmer: End-to-End 2026 Guide
How to build a Civil 3D plugin with Claude Code without coding experience: architecture, prompts that work, and how to compile and deploy it.
Dynamo vs C# in Civil 3D and Revit: when to use each + automations that save hours
Dynamo or C# for automating Civil 3D and Revit: the real differences, when each one is worth it, and automations that save hours, with examples.
How much does a Revit or Civil 3D add-in cost? 2026 pricing and timeline guide
How much a Revit or Civil 3D add-in costs to build: what drives price and timeline, and how to calculate whether it pays for itself in hours saved.