Cryptoria Bitcoin/Sats Converter

Security Report Card

Readiness

PHP Compatibility

Categories with Findings

Positive Observations

• Zero server-side entry points beyond the Settings API page: no wp_ajax_, no register_rest_route, no custom form handlers, no file operations, no cron — a minimal attack surface.
• Settings are registered through register_setting() with a sanitize_callback and the page is gated by manage_options; CSRF protection comes from settings_fields()/options.php core handling.
• The sanitize() routine is unusually defensive: it rejects non-array and malformed nested shapes without PHP warnings, preserves previously valid stored values on invalid input, allowlists mode/currency/preset, and canonicalizes rate strings without floatval.
• Hex colour handling is strictly validated to canonical #RRGGBB via regex plus sanitize_hex_color(), and the custom style attribute is built only from allowlisted CSS variable names with sanitized values, then esc_attr()-escaped — no CSS injection path.
• All admin and shortcode output is consistently escaped with context-appropriate esc_html/esc_attr/esc_url/esc_html__; the JSON config blob is passed through wp_json_encode and esc_attr.
• Admin assets are loaded only on the plugin's own settings screen via hook-suffix comparison; frontend assets are registered but enqueued only when the shortcode actually renders.
• Frontend math uses exact BigInt/decimal-string arithmetic with grammar-based classification, digit-length caps, and no eval/innerHTML — status and error messages are set via textContent only.
• math.js is deliberately parse-safe on non-BigInt browsers (no BigInt literals or calls at module-evaluation time) and failure states keep controls disabled rather than showing fabricated results.
• uninstall.php deletes only the plugin's own option behind the WP_UNINSTALL_PLUGIN guard; deactivation preserves settings as documented.
• No external HTTP requests, no telemetry, no cookies/localStorage use — matching the privacy claims in the readme.
• Controls are rendered disabled server-side and only enabled after the math module successfully loads, preventing silent no-JS failures.
• Accessibility is thoughtfully handled: aria-live regions, aria-describedby wiring, focus-visible outlines, screen-reader text on swatches, prefers-reduced-motion support, and disabled-state ARIA mirroring.
• All PHP entry files include the defined( 'ABSPATH' ) || exit guard, and uninstall.php has the WP_UNINSTALL_PLUGIN guard.
• Defaults are applied entirely in code and never written to the database on activation or page view, avoiding option bloat and making the option schema forward-compatible by design.
• Rate and color sanitization is strict and defensive: parse_rate_string rejects zero, negatives, exponents, grouping and NaN/Infinity without floatval; sanitize_hex validates full 6-digit hex and delegates to sanitize_hex_color; nested shapes are rejected without PHP warnings.
• Frontend and admin output is consistently escaped (esc_html, esc_attr, esc_url, checked/selected with $echo=false) and the runtime config JSON is emitted via esc_attr( wp_json_encode() ).
• No external network requests anywhere; the plugin genuinely makes no API calls, telemetry, or third-party asset loads (wp-color-picker and jQuery are core).
• Assets are registered but only enqueued when a shortcode renders, so pages without the converter load zero plugin CSS/JS; admin assets are scoped to the plugin's hook suffix.
• Front-end JS is an ES module using BigInt with decimal-string parsing (no binary floats), lazy BigInt constants, and graceful degradation (controls rendered disabled, enabled only after the math module loads; distinct unsupported vs load-error states).
• Text domain 'cryptoria-sats-converter' matches the header everywhere, translators comments accompany sprintf placeholders, and wp_date() is used instead of date() for locale/timezone-correct display.
• Hooks are registered from the main plugin file via init() methods rather than class constructors, avoiding conditional-load ordering bugs; settings hooks are correctly gated behind is_admin().
• No logging, var_dump/print_r, or @ error suppression in production paths; error handling checks array/string shapes before use and JS wraps JSON.parse and dynamic import in try/catch or .catch.
• readme.txt provides an honest, clear privacy statement and feature/limitation documentation consistent with the code.
• Frontend inputs (rate, fiat, BTC, sats) all use proper <label for> / id pairing.
• Error spans and status regions use aria-live="polite" and role="status"; errors are linked via aria-describedby and aria-invalid.
• Converter wrapper uses role="group" with aria-labelledby tying it to its title.
• Currency selection is a proper <fieldset>/<legend> group with native radio inputs.
• All interactive controls are native <input>/<button> elements, so they are keyboard-accessible by default (no div/span click handlers).
• Visible focus indication via :focus-visible outlines with adequate non-text contrast.
• prefers-reduced-motion media query disables transitions.
• Admin colour swatch is a real <button> with aria-expanded, aria-haspopup="dialog", aria-controls and screen-reader text; Escape closes the picker and returns focus to the trigger.
• Colour picker degrades to a keyboard-accessible HEX text input when Iris is unavailable (csc-no-iris fallback).
• No images, icon fonts, SVG or media requiring alt/captions; no external tracking/analytics.
• Status table uses scope attributes and a small friendly status summary.