Security

WP Agent Bridge is built around explicit authorization, least-privilege operations and recoverable changes.

Core controls

• Allowlisted operations instead of unrestricted shell execution
• Dry-run and deterministic state/plan hashes for guarded writes
• SHA conflict protection for file changes
• Snapshots and rollback where supported
• Audit records and change receipts
• Secret redaction from diagnostic responses
• Dynamic discovery limited to public, read-only, non-destructive abilities
• Encrypted local Cloud session storage

OAuth boundaries

OAuth authorization requires explicit user consent. Public browser code contains only the Supabase publishable key; service-role credentials remain backend-only. Client names, redirect URIs and scopes are rendered as text, not executable HTML. Authorization requests use PKCE and tokens are issued by Supabase Auth.

Cloud boundaries

Service-role credentials remain backend-side. WordPress receives only the session required for the authorized account and stores it encrypted locally. Cloud status endpoints are designed not to return raw access or refresh tokens.

Responsible disclosure

If you believe you found a security issue, email [email protected] with a clear description and safe reproduction steps. Do not include active credentials or exploit unrelated systems.

Scope

Only test installations and accounts you own or have explicit permission to assess. Avoid actions that could affect availability, data integrity or other users.