SPP Ready Repo

=== SPP Ready Repo === Tags: plugin development, security, code review, wordpress.org, plugin scanner Requires at least: 6.4 Tested up to: 7.0 Requires PHP: 7.4 Stable tag: 1.5.1 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html

Audit WordPress plugins for repository readiness, security, performance, compatibility, dependencies, packaging, and release regressions.

== Description ==

SPP Ready Repo gives plugin developers a clear, local-first pre-release review inside WordPress.

It can scan an installed plugin or inspect a release ZIP without installing it. Findings are grouped by severity and category, written in straightforward language, and paired with source context and a suggested next step.

Key features include:

• Installed plugin and release ZIP scans.
• Quick scans for release blockers and full scans for deeper review.
• WordPress.org readiness checks for headers, readme metadata, licensing signals, naming, packaging, and release consistency.
• Security checks for request data, SQL usage, REST permissions, AJAX nonce patterns, dangerous execution, redirects, file writes, and possible secrets.
• Performance checks for potentially unbounded queries, blocking waits, rewrite flushing, remote requests, and other expensive patterns.
• PHP compatibility checks based on the plugin's declared minimum PHP version.
• Internationalization and text-domain consistency checks.
• Composer and npm dependency summaries plus release-package checks.
• Scan history with score changes and regression comparison.
• Developer decisions: open, fixed, ignored, false positive, and accepted risk.
• Intentional exceptions such as ignored findings, false positives, and accepted risks are remembered on later scans using stable finding fingerprints.
• HTML, JSON, and CSV report exports.
• Local-first operation. Scanned source code is not sent to an external service.

SPP Ready Repo is an automated development aid. Passing a scan does not guarantee acceptance into the WordPress.org Plugin Directory. WordPress.org performs its own automated and human review.

== Installation ==

1. Upload the spp-ready-repo folder to /wp-content/plugins/ or install the ZIP from Plugins > Add New.
2. Activate SPP Ready Repo.
3. Open SPP Ready Repo in the WordPress admin menu.
4. Select an installed plugin or upload a release ZIP.
5. Run a Quick Scan or Full Scan and review the findings.

== Frequently Asked Questions ==

= Does SPP Ready Repo modify the plugin it scans? =

No. Installed plugin scans are read-only. ZIP scans unpack the archive to a temporary directory for analysis and remove the temporary files after the scan.

= Is plugin source code sent to another server? =

No. The scanner is local-first and does not require an external API or account.

= Does a 100/100 score guarantee WordPress.org approval? =

No. Automated analysis cannot replace the WordPress.org review process. The score is guidance that helps developers prioritize issues before submission.

= What database tables are created? =

The plugin uses the site's WordPress database prefix followed by spp_. On a default installation the tables are wp_spp_scans, wp_spp_findings, and wp_spp_decisions.

= Can I mark a warning as a false positive? =

Yes. Open a finding and save a developer decision. The decision is remembered when the same fingerprint is detected on future scans of that plugin.

== Changelog ==

= 1.5.1 =

• Improved WordPress Plugin Check compatibility across internationalization, escaping, nonce review, and custom-table SQL.
• Prepared SPP-owned database table identifiers with WordPress identifier placeholders and tightened query construction.
• Removed the unnecessary manual plugin text-domain loader for WordPress.org-hosted translations.
• Added scoped documentation for intentional custom-table and uninstall database operations.
• Removed page-level horizontal overflow in the admin interface and added responsive scan-history cards for narrow screens.
• Improved wrapping for long file paths, rule identifiers, filters, navigation, and finding details.

= 1.5.0 =

• Initial public release combining V1 and V1.5 scope.
• Added local installed-plugin and release-ZIP scanning.
• Added repository readiness, security, performance, code-quality, compatibility, internationalization, packaging, and dependency analysis.
• Added scan history and regression comparison.
• Added persistent false-positive and accepted-risk decisions.
• Added HTML, JSON, and CSV report exports.
• Added professional responsive admin interface with plain-language guidance and accessible tooltips.