32e21bc59d
Security (7 fixes): - SEC-001: Use wpdb->prepare() for COUNT query in REST API - SEC-002: Set httponly=true on session cookie to prevent XSS - SEC-003: Mask API keys in admin settings (show last 4 chars only) - SEC-004: Check capability before nonce in manual fetch handler - SEC-005: Validate redirect domains to prevent open redirects - SEC-006: Escape all article fields before REST API response - SEC-007: Add capability check to AJAX summary handler Infrastructure (7 fixes): - WPS-002: Clear cron schedule on plugin deactivation - WPS-003: Bundle Chart.js locally instead of CDN without SRI - WPS-004: Add uninstall.php for clean plugin removal - DB-001: Add foreign key constraints with CASCADE deletes - DB-002: Clamp pagination to valid page range - CI-001: Use StrictHostKeyChecking=accept-new in deploy - CI-002: Add security scanning step to CI pipeline - CI-003: Add rollback workflow via workflow_dispatch Performance & Quality (8 fixes): - PHP-001: Validate widget $instance as array before access - PHP-002: Return null from get_client_ip() for invalid IPs - PHP-003: Process RSS feeds in chunked batches of 10 - PHP-004: Wire up clear_article_cache() in fetch cycle - PERF-001: Cache source names in transient for strip_source_suffix - PERF-002: Add server-side transient caching for REST API - ARCH-002: Make LLM API URL configurable via WordPress options Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
26 lines
214 B
Plaintext
26 lines
214 B
Plaintext
# IDE
|
|
.idea/
|
|
.vscode/
|
|
*.swp
|
|
*.swo
|
|
|
|
# OS
|
|
.DS_Store
|
|
Thumbs.db
|
|
|
|
# WordPress
|
|
wp-config.php
|
|
wp-content/uploads/
|
|
|
|
# Dependencies
|
|
node_modules/
|
|
vendor/
|
|
|
|
# Logs
|
|
*.log
|
|
debug.log
|
|
|
|
# Build artifacts
|
|
*.zip
|
|
QA_REVIEW_REPORT.md
|