// CODE REVIEWERS

Find a Reviewer

Automated tools catch roughly 30% of the real problems in AI-generated code. A human who has seen enough AI output to know where the gaps are will find the rest.

No linter

catches a rate limiting feature that defaults to off. The code is syntactically correct. The behavior is a security hole.

No scanner

flags the gap between a cipher that works and one that is authenticated. AES-256-CBC passes every automated check. It is not authenticated encryption.

No tool

catches an admin-configurable URL being passed to an HTTP client without a hostname allowlist. That is an SSRF vulnerability by design.

“The code quality is better than most plugins I see. First pass I was going to grade it B+. Then I dug into the feature logic.”

— Marcin Dudek, after reviewing a vibe-coded WordPress plugin

Rafael Moreno

WordPress Plugins

Book a Review

BACKGROUND

Former WordPress core contributor with 12 years of plugin development. Reviews AI-generated plugins for security gaps that automated scanners consistently miss.