robotstxt-documentation-markdown/docs/deploy-checklist-1.1.1.md

Pre-Deploy Checklist — Version 1.1.1

Date: 2026-06-08 Plugin: Documentation Markdown (by ROBOTSTXT) Version: 1.1.1

---

INPUT VALIDATION

• Empty field validation performed
• Length limits validated server-side
• Format patterns validated (regex, ctype_alnum, preg_match)
• Safelist validation for finite option sets
• Strict type checking (===, in_array with true)
• Validation BEFORE any action or processing
• robotstxt_docmd_input_string() / robotstxt_docmd_input_int() for all superglobal access

INPUT SANITIZATION

• sanitize_text_field() for single-line text
• sanitize_key() for keys/identifiers
• sanitize_text_field() for github_url (functional; sanitize_url() deferred to v1.2.0 — known-issues.md)
• wp_unslash() before sanitizing superglobals

OUTPUT ESCAPING

• esc_html() for HTML element content
• esc_attr() for HTML attributes
• esc_url() for all URLs
• esc_js() for inline JavaScript (delete confirm)
• esc_html__(), esc_attr_e() combined i18n+escape functions
• Numeric variables: absint(), (int)
• wp_kses_post() for debug details and status badges
• Escaping at output time, not before storage

CSRF PROTECTION

• wp_nonce_field() on all forms (save_mapping, save_settings)
• wp_nonce_url() for action URLs (sync, delete)
• check_admin_referer() for all GET state-changing actions
• wp_verify_nonce() in save handlers and updater cache clear
• Nonce action strings are specific (include mapping_id)
• Nonces NOT used for authorization

DATABASE SECURITY

• $wpdb->prepare() for all custom SQL (transient cleanup)
• $wpdb->esc_like() for LIKE patterns
• WordPress API functions for CPT and post meta
• No $_POST/$_GET interpolation in queries

CAPABILITY CHECKS

• current_user_can('edit_pages') on every admin page render
• current_user_can('edit_pages') in every handler
• current_user_can('update_plugins') in updater cache clear
• Capability checks in UI rendering (wp_die if no permission)
• Capability checks in execution logic

FILE OPERATIONS

• ABSPATH guard on every PHP file
• base64_decode() strict with length validation (fixed in 1.1.1)
• No user file uploads managed by this plugin

DANGEROUS FUNCTIONS

• No eval()
• base64_decode() only for GitHub API content decode (documented necessity)
• No system(), exec(), shell_exec(), passthru()
• No unserialize() — serialize() replaced with wp_json_encode() in 1.1.1

CODE QUALITY & STANDARDS

• PHPCS: 0 errors, 0 warnings — 7 files, no exclusions
• PHPStan level 9: 0 errors — 7 files, no exclusions
• PHPCompatibility 10.0.0-alpha2: 0 errors (PHP 8.0–8.5)
• Requires PHP: 8.0 (real minimum confirmed by PHPCompatibility scan)
• All i18n strings use textdomain 'robotstxt-documentation-markdown'
• phpDoc on all public functions/methods/hooks

TESTING

• PHPUnit: 17/17 tests OK (plugin header tests)
• Stable tag 1.1.1 = Version 1.1.1 = ROBOTSTXT_DOCMD_VERSION = update.json version ✓

VERSIONING & DOCUMENTATION

• Plugin header: Version: 1.1.1
• ROBOTSTXT_DOCMD_VERSION constant: '1.1.1'
• CHANGELOG.md updated
• changelog.txt updated (WP.org format)
• readme.txt: Stable tag 1.1.1, Requires PHP 8.0, Tested up to 7.1
• update.json: version 1.1.1, requires_php 8.0, tested 7.1
• README.md — no new external dependencies added

DATABASE & UNINSTALL

• uninstall.php exists and respects data preservation option
• No custom DB tables — documented in docs/db-migrations.md
• Settings stored with autoload=false (fixed in 1.1.1)

AI AUDIT

• Pre-deploy AI audit executed on full codebase
• All [CRITICAL] findings resolved (Finding 011: CommonMark html_input:strip)
• [WARNING] findings deferred documented in docs/known-issues.md
• Audit report: docs/audit-pre-deploy-1.1.1.md
• Executive summary: PASS
• Security risk: Low

BUILD & ARTIFACT

• deploy.sh executed manually — artifact generated
• ZIP excludes dev files (composer.json, phpstan.neon, .phpcs.xml, tests/, docs/, bin/, AGENTS.md, CLAUDE.md)
• Production vendor/ included (no require-dev packages)
• *.po files excluded (only .mo bundled)

---

DEPLOY AUTHORIZATION

• All [CRITICAL] items resolved: YES
• Executive summary: PASS
• Security risk: Low
• Manual approval: YES