Every time you save a snippet, GOCSM checks its code for patterns that often signal a security problem, and shows the results in the Security Scan card on the snippet’s edit screen.
The scan is advice. It never blocks saving or activating a snippet, and a clean result does not prove that code is safe: it only means none of these patterns appeared. Review any snippet you did not write yourself, whatever the scan says.
What the scan looks for #
Each finding has a severity and, where it can be found, the line number.
| Severity | Examples |
|---|---|
| High | PHP eval(), create_function(), and shell commands such as exec(), shell_exec(), system() or backticks. JavaScript eval() and new Function(). Credentials written into the code, such as live Stripe keys, AWS keys, GitHub, Slack, Google or AI provider tokens, and private keys. |
| Medium | Functions often used to hide code, such as base64_decode(), gzinflate() and str_rot13(). unserialize(), which is unsafe on data from visitors. Including a file from a variable path. Timers given a string of code. Scripts loaded over plain http://. |
| Low | Reading $_GET, $_POST and other request data directly, as a reminder to sanitize it and check a nonce. document.write(). Stylesheets imported over plain http://. |
PHP is checked token by token, so text inside strings and comments is never reported, and method calls such as $object->exec() are not mistaken for the PHP function of the same name. JavaScript, CSS and HTML are checked by pattern, so a match inside a comment can be reported.
Acting on findings #
- Credentials — move the secret out of the snippet, into
wp-config.phpor an environment variable, and read it from there. A snippet’s code is stored in the database, kept in its revision history and included in exports. - Code execution and shell commands — make sure nothing a visitor sends can reach the code being run.
- Obfuscation — find out what the encoded content is before activating the snippet.
Developers can add their own checks, or remove findings they have reviewed, with the gocsm_security_scan_findings filter. See Actions and Filters.
