Before the coffee is cold
Testing the security of AI-written WordPress code, in the open.
Jun 26, 20263 min read54
Command Palette
Search for a command to run...
Series
AI-written WordPress security
A hands-on series testing whether AI-generated WordPress code is secure, from the simplest plugin to the complex.
Sanitize on input, escape on output: the WordPress rule behind XSS
Two WordPress functions people constantly mix up, and the XSS hole that opens when they do.
Jun 27, 20265 min read36
I tried to prove AI writes insecure WordPress code
A fair test, every plugin read by hand, and a result I did not expect.
Jul 1, 20268 min read25
So, can you stop checking AI's WordPress code?
Same request, three assistants, twenty-four injection-safe plugins, and the one default that split them.
Jul 11, 202612 min read22
Safe by accident
The AI wrote WordPress code that escapes JavaScript correctly. Then I asked whether it was safe on purpose, or safe by luck.
Jul 20, 202619 min read27