The Vibe Coding Checklist

Run through this before you ship. These are not syntax rules — they are design-level questions that no automated tool will ask for you.

Rate Limiting

0/4

Does every public-facing form submission endpoint have rate limiting enabled? Does rate limiting default to ON, not opt-in? Is rate limiting enforced per-IP? For features that send outbound email, is there also a per-recipient cooldown to prevent distributed IP abuse?

Encryption

0/3

Are sensitive values (API keys, tokens) encrypted at rest — not just base64 encoded? Are you using authenticated encryption (AES-256-GCM or similar) rather than unauthenticated (AES-256-CBC)? Is your encryption key derived from a secret constant, not from predictable values like site URL or database prefix?

External Requests (SSRF)

0/2

For any URL that comes from user input or admin configuration, is it validated against a hostname allowlist — not just checked for HTTPS? Is HTTPS validation present (necessary but not sufficient on its own)?

Email

0/2

If you intercept wp_mail() or equivalent, does your filter return null (not false) on failure, so the fallback mailer can run? Would a Brevo/SendGrid/Mailgun outage silently drop WooCommerce order emails, 2FA codes, and password resets?

Public Endpoints

0/2

Do any public endpoints return different status codes for valid vs invalid identifiers? (A 200/404 difference lets attackers enumerate valid slugs.) Are public endpoints that touch the database rate-limited?

Supply Chain

0/3

Does your GitHub/GitLab release workflow generate a hash of the release artifact? Does your auto-updater verify that hash before installing? Does it fail closed (block the update) if the hash file is missing?

Output Escaping

0/1

Is every piece of dynamic data wrapped in esc_html(), esc_attr(), or equivalent before being echoed into HTML — including boolean ternary expressions?

Input Handling

0/2

Is there an is_string() guard before calling sanitize functions on $_POST values that might be arrays? Is wp_unslash() called exactly once per value — not by both the caller and the called function?

Still not sure? That's what the reviews are for.

Find a reviewer →

The things your scanner won't catch.