WordPress.Security.EscapeOutput.OutputNotEscaped (x3):
- Lines 110+148: inline esc_url( admin_url() ) directly in echo; drop pre-assigned $form_url
- Line 128: replace $disabled variable with literal-conditional
( $is_const ? ' disabled aria-disabled="true"' : '' ) — no dynamic value
PEAR.Functions.FunctionCallSignature.ContentAfterOpenBracket (x1):
- Line 116: move esc_html( opening to its own line so arg starts on next line
Full file audit: no other unescaped echo found; $nonce data-attr uses esc_attr(),
$ajax_url uses esc_url(), inline <script> has existing phpcs:ignore.
No behavior change; password input still renders empty.
CHANGELOG [0.2.3]: one-line note — output-escaping hardening in key manager renderer.
Agent-Session: geomonitor / 2026-06-15
85956da7c8