Security Notes

Security considerations for wpzylos-wp-cli.

CLI Access

WP-CLI runs with elevated privileges. Restrict dangerous commands:

// Check before destructive operations
public function reset(array $args, array $assocArgs): void
{
    if (!isset($assocArgs['force'])) {
        WP_CLI::confirm('This will delete all data. Continue?');
    }
    // ... proceed
}

Environment Detection

Don't run production-dangerous commands in production:

if (wp_get_environment_type() === 'production') {
    WP_CLI::error('This command cannot run in production.');
}

Related

• Security Package