GT Development Tools WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC- GitLab

High-severity findings.

Audited release

1.0.2

Findings

1

Worst severity

high

Content hash

c1d8940fd924b4b4c0e9ef1d… Copy

Findings

• high Whoops pretty-error handler enabled unconditionally

  dev_tool_in_production

  On plugins_loaded the plugin always constructs Whoops\Run, pushes PrettyPageHandler (vscode editor), and register()s it. There is no WP_DEBUG, WP_ENVIRONMENT_TYPE, or is_admin() guard. On a production site this replaces WordPress error handling with a public debug page that discloses filesystem paths, source snippets, and request data to unauthenticated visitors whenever a PHP error or exception occurs. Kint is also initialized globally.

  lib/Support/WhoopsLoader.php:28-35

  Recommendation

  Register Whoops only when WP_DEBUG is true and WP_ENVIRONMENT_TYPE is local/development. Do not ship this plugin to production sites; add an explicit opt-in constant.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.