5.4 KiB
PRE-DEPLOY CHECKLIST — Version 2.1.6
═══════════════════════════════════════════════════════════════ PRE-DEPLOY CHECKLIST — Version 2.1.6 ═══════════════════════════════════════════════════════════════
INPUT VALIDATION [x] Empty field validation performed [x] Length limits validated server-side [x] Format patterns validated (regex, ctype_alnum, preg_match) [x] Safelist validation used for finite option sets — scope param uses sanitize_key() + strict equality [x] Strict type checking used (===, in_array with true parameter) [x] Validation performed BEFORE any action or processing [x] Helper functions used: is_email(), sanitize_key()
INPUT SANITIZATION [x] sanitize_text_field() for single-line text — credentials [x] sanitize_textarea_field() for multi-line text — n/a [x] sanitize_email() for email addresses — reply_to_email [x] sanitize_key() for keys/identifiers — scope, cleared_key params [x] sanitize_url() for URLs — n/a (no URL inputs) [x] sanitize_file_name() for filenames — n/a [x] wp_kses() / wp_kses_post() for HTML content — n/a
OUTPUT ESCAPING (Escape Late) [x] esc_html() for HTML element content [x] esc_attr() for HTML attributes — field names, placeholder text [x] esc_url() for all URLs (src, href) — wp_nonce_url() output + esc_url() [x] esc_js() for inline JavaScript — n/a [x] Combined i18n+escape functions (esc_html__(), esc_attr_e()) [x] Escaping performed at output time, not before storage
CSRF PROTECTION (Nonces) [x] wp_nonce_url() used for clear credential action links [x] wp_verify_nonce() verifies the clear credential handlers (GET via admin-post.php) [x] Nonce action strings are specific ('robotstxt_smtp_amazonses_clear_access_key', 'robotstxt_smtp_amazonses_clear_secret_key') [x] Nonces NOT relied upon for authentication/authorization — capability checks are separate
DATABASE SECURITY [x] WordPress API functions used — update_option(), update_site_option(), get_option(), get_site_option() [x] No custom SQL queries [x] No direct $_POST/$_GET interpolation in DB operations
CAPABILITY CHECKS [x] current_user_can() on every admin action — handle_clear_credential() checks manage_options / manage_network_options [x] current_user_can() on every AJAX/admin-post handler [x] Capability checks in execution logic (reject if no permission — wp_die()) [x] Appropriate capability selected
FILE OPERATIONS [x] Direct file access prevention on all PHP files (ABSPATH guard)
DANGEROUS FUNCTIONS [x] No eval() usage [x] No suspicious base64_decode() [x] No system(), exec(), shell_exec(), passthru() [x] No create_function() (use anonymous functions) [x] No extract() on untrusted data [x] No unserialize() on untrusted data
CODE QUALITY & STANDARDS [x] PHPCS passes with zero errors (WordPress-Core, WordPress-Docs, WordPress-Extra) [x] PHPStan level 9 passes with zero errors on all modified files [x] PHPCompatibility scan run — 8.2-8.5 PASSED [x] Minimum PHP version in headers reflects real lowest compatible version (8.2 — AWS SDK) [x] All user-facing strings use translation functions (textdomain = 'robotstxt-smtp-amazonses') [x] phpDoc added for all new public methods/hooks with @since 2.1.6
DEBUG & TESTING [x] Browser console — no new JS introduced [x] composer audit — no CVEs found [x] No PHP notices, warnings, or deprecated messages expected
VERSIONING & DOCUMENTATION [x] Plugin version bumped in main plugin file header — 2.1.6 [x] CHANGELOG.md / changelog.txt updated [x] readme.txt updated — last 3 versions shown (2.1.4, 2.1.5, 2.1.6) [x] Stable tag in readme.txt matches Version in plugin header — both 2.1.6 [x] Required headers present, forbidden headers absent [x] update.json version and download_url updated
DATABASE & UNINSTALL [x] No DB schema changes in this version [x] uninstall.php delegates to parent plugin
AI AUDIT [x] Pre-deploy AI audit executed — docs/audit-pre-deploy-2.1.6.md [x] All [CRITICAL] findings resolved — none found [x] [WARNING] finding documented and resolved (FILTER_UNSAFE_RAW → FILTER_SANITIZE_SPECIAL_CHARS + sanitize_key) [x] Executive summary: PASS [x] Security risk assessed as: Low
BUILD & ARTIFACT [x] deploy.sh executed manually [x] ZIP generated in parent directory (wp-content/plugins/) [x] ZIP excludes: vendor/ dev deps, tests, CI config, .git, phpstan.neon, composer.json, CLAUDE.md, AGENTS.md [x] Production dependencies bundled (AWS SDK + runtime deps only) [x] License compatibility verified — GPLv3, AWS SDK Apache-2.0 (GPL-compatible)
═══════════════════════════════════════════════════════════════ DEPLOY AUTHORIZATION ═══════════════════════════════════════════════════════════════ All [CRITICAL] items resolved: YES Executive summary status: PASS Security risk level: Low
Manual approval confirmed: [x] YES ═══════════════════════════════════════════════════════════════