Security Notes
Security considerations for wpzylos-config.
Sensitive Configuration
Don't Store Secrets in Config Files
Config files may be committed to version control:
// Bad: Secret in config file
return [
'api_key' => 'sk_live_abc123',
];
// Good: Load from environment
return [
'api_key' => getenv('MY_PLUGIN_API_KEY'),
];
Protect Config Directory
Prevent direct access via web:
# .htaccess in config/
<IfModule mod_authz_core.c>
Require all denied
</IfModule>
Runtime Security
Validate Config Values
Don't trust config blindly if it can be modified:
$callback = $config->get('hooks.callback');
// Bad: Execute arbitrary callback
call_user_func($callback);
// Good: Validate before execution
if (is_callable($callback) && $this->isAllowedCallback($callback)) {
call_user_func($callback);
}