- Create PSA_Encryption class with AES-256-CBC encrypt/decrypt methods
- Derive encryption key from wp_salt('auth') using SHA-256 hash
- Prepend IV to ciphertext and base64-encode for safe storage
- Update PSA_Admin to encrypt API keys on save, mask on display
- Preserve existing key when empty/mask value submitted (no overwrite)
- Update PSA_AI_Generator to decrypt API key on read from database
- Maintain backward compatibility with plaintext keys (auto-encrypt on next save)
- Prefer wp-config constant over database value for maximum security
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
SEC-001 CRITICAL: Remove spoofable X-Forwarded-For/X-Real-IP from IP detection; trust only CF-Connecting-IP + REMOTE_ADDR
SEC-004 HIGH: Add peptide name input validation with character whitelist and prompt injection blocking
SEC-006 HIGH: Add missing return after wp_send_json_success in handle_pending_retry max-retries block
SEC-007 MEDIUM: KB articles now respect auto_publish setting instead of always publishing
SEC-009 MEDIUM: Replace hardcoded page ID 73 with configurable kb_page_id setting
SEC-010 MEDIUM: Fix cache invalidation — add underscore prefix to transient name pattern
SEC-011 MEDIUM: Skip sleep() during WP-Cron to avoid blocking PHP workers on rate limit retry
SEC-012 MEDIUM: Add global daily generation cap (50/day) to prevent cost overruns
SEC-013 LOW: Add @deprecated notice to unused PSA_Error class
SEC-015 LOW: Convert uninstall.php from space to tab indentation (WPCS)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
