Disciple.Tools - Custom Login WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

Low-severity findings only.

Audited release

0.3

Findings

1

Worst severity

low

Content hash

5d52b68345ad197b1700b6af… Copy

Findings

• low Unfinished SSO REST surface with __return_true and namespace mismatch

  dev_tool_in_production

  Facebook and Google SSO classes are marked @todo / admin UI commented out, yet when keys exist they register CREATABLE REST routes (register_via_facebook/google, link_account_via_*) with permission_callback __return_true under namespace location_grid/v1. Frontend JS posts to /dt_custom_login/v1/... instead. Token verification via provider SDKs mitigates naive abuse, but unfinished public registration endpoints and wrong route URLs are unnecessary attack surface.

  additional-logins/facebook.php:124-140

  Recommendation

  Finish or remove SSO until production-ready; align REST namespace with JS; require explicit feature flag; keep permission_callback __return_true only with strict provider token verification and email/account binding checks.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.