Sleep Apnea Estimator + GoHighLevel WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

Low-severity findings only.

Audited release

1.0.29

Findings

1

Worst severity

low

Content hash

588a957e38176a2f5285683a… Copy

Findings

• low Nopriv sapn_track inserts events without nonce

  dos

  wp_ajax_nopriv_sapn_track calls sapn_ajax_track_event which inserts into sapn_events with only event_type allowlist and non-empty session_id — no nonce, no rate limit. Unauthenticated clients can flood the events table (DoS/storage). Lead submit path separately verifies sapn_submit nonce and is an intentional public form.

  sleep-apnea-ghl.php:751-772

  Recommendation

  Require a public nonce (wp_create_nonce localized to the page), rate-limit by IP/session, and/or cap table growth.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.