Security Notes

Security considerations for WPZylos CLI Devtool.

Development-Only Tool

Important: This tool is intended for development use only. Do not include it in production deployments.

Install as a dev dependency:

composer require --dev KYNetCode/wpzylos-cli-devtool

File Generation Safety

Overwrite Protection

By default, commands will not overwrite existing files:

vendor/bin/wpzylos make:controller ProductController
# Created: app/Http/Controllers/ProductController.php

vendor/bin/wpzylos make:controller ProductController
# Error: File already exists

Path Validation

The tool validates output paths to prevent writing outside the plugin directory:

// Good: Valid paths
app/Http/Controllers/ProductController.php
database/migrations/2024_01_01_create_products.php

// Bad: Invalid paths (blocked)
../../etc/passwd
/var/www/other-project/file.php

Input Validation

All command arguments are validated:

# Bad: Invalid names are rejected
vendor/bin/wpzylos make:controller "../../../malicious"
# Error: Invalid controller name

# Good: Valid names
vendor/bin/wpzylos make:controller ProductController

Generated Code Security

Generated code follows WordPress security best practices:

Capability checks in controllers
Nonce verification placeholders
Input sanitization reminders
Output escaping patterns

Best Practices

Review generated code — Always review before committing
Don't commit dev tools — Exclude from production builds
Use version control — Track all generated files
Test locally first — Validate generated code works

wpzylos-security — Security utilities
wpzylos.com — Full documentation

Testing

Troubleshooting