Execution & obfuscation
Detect dangerous execution primitives and suspicious encoded/compressed executable patterns.
Per-version plugin health
Static WordPress plugin security checks with findings you can inspect.
Every successful FlowHelpdesk release is checked against deterministic security rules. Findings stay attached to the exact source version and include severity, explanation, file location where available and remediation guidance.
Deterministic rules Per-version reports High-severity packaging gate No false security guarantee
Built around the requirement
“AI says it looks secure” is not useful security evidence.
FlowHelpdesk separates code generation from deterministic static analysis. The checks are repeatable and concrete, while the product is explicit that runtime testing and professional security review may still be required.
SQL & request handling
Flag common request-to-query and request-to-output patterns that warrant sanitisation, escaping or parameterisation.
REST & AJAX authorisation
Review REST permission callbacks, explicitly public routes and AJAX handlers lacking an obvious nonce check.
Credentials & transport
Surface potential hard-coded secrets and non-local plain-HTTP remote endpoints.
Filesystem & inclusion
Flag direct file writes and variable-driven include/require patterns for closer review.
Packaging gate
Generated source with high or critical static findings is stopped before ZIP packaging and does not consume a successful-build credit.
From brief to release
A development workflow customers can actually understand.
FlowHelpdesk keeps the generated source visible and the lifecycle explicit rather than hiding everything behind a single AI response.
Generate the source
The plugin must first pass request-policy, structural and source-validation boundaries.
Run deterministic rules
Security and compatibility scanners assess the exact generated source rather than a prose summary.
Keep the evidence with the version
Reports remain queryable and rerunnable against the immutable source they originally assessed.
Evidence, not magic words
Static analysis is a layer of evidence, not a certificate of safety.
FlowHelpdesk does not market a green badge as a guarantee. The next engine phase adds disposable WordPress installation, activation and runtime behaviour testing on top of the static checks already live.
Server-side acceptable-use reviewMalicious, deceptive, piracy and unauthorised-access requests are blocked.Source is yours to inspectEvery saved release keeps a complete source specification and installable ZIP.Per-version health historyStatic security and compatibility reports stay attached to the source they assessed.
Frequently asked questions
Before you build.
Specific answers about this FlowHelpdesk workflow, its boundaries and what you receive.
Does a passed static check mean a WordPress plugin is completely secure?
No. Static analysis can identify important risky patterns but cannot prove that code is vulnerability-free or safe in every runtime configuration. FlowHelpdesk states that limitation explicitly.
What does the security checker look for?
Current deterministic rules cover dangerous execution primitives, suspicious dynamic includes, unsafe unserialisation, request-to-output and request-to-SQL patterns, hard-coded credentials, insecure remote URLs, filesystem writes, REST permissions, AJAX nonce checks and related hardening signals.
Are findings attached to a specific plugin version?
Yes. Reports are persisted against the immutable saved version they assessed, so a later update does not rewrite the evidence from an earlier release.
Can I rerun a security or compatibility report?
Yes. Saved versions can be rechecked without consuming a plugin build credit.
Generate a plugin with an inspectable health trail from its first release.
Create an account, describe the requirement and keep the generated source and version history in your FlowHelpdesk workspace.