AI Connector Secure Layer

AI Connector Secure Layer Keeps LLM API keys out of the WordPress database. Works with WordPress 7.0 AI Connectors and Pantheon Secrets. The problem WordPress 7.0 AI Connectors store API keys in wpoptions by default. A database dump, SQL injection, or any plugin vulnerability that exposes the database immediately exposes every API key on the site — with no active session required. How this plugin works Instead of storing keys in the database, the plugin fetches them on-demand from Pantheon Secrets (or environment variables) at the exact moment an LLM HTTP request is made — and only then. What this protects against: - Database dump — no key is ever written to wpoptions - Broad PHP execution — no PHP constant is defined; the key is not in any global - Idle requests — key only exists in memory during an active LLM API call What this does not protect against: - An attacker with PHP code execution who knows to call pantheongetsecret() directly can still retrieve the key. No server-side architecture can prevent this: the key must be available to PHP when the LLM call is made. See the detailed threat model notes in the Security Model section. Requirements - WordPress 7.0+ - PHP