# Security Scanning Methodology

> Every Royal Plugin passes multi-engine security scanning before release, combining static analysis, WordPress-specific checks and vulnerability detection.

- Canonical: <https://royalplugins.com/security-methodology/>
- HTML version: <https://royalplugins.com/security-methodology/>

---

Every Royal Plugin passes multi-engine security scanning before release.

## How We Test

#### WordPress-Specific Checks

- PHP\_CodeSniffer with WordPress Security standards
- Nonce verification validation
- Proper escaping context analysis

#### Best Practice Enforcement

- Input sanitization requirements
- Output escaping standards
- Direct file access protection

## What We Scan For

| Category | Description |
| --- | --- |
| **Injection** | SQL injection, command injection, code injection |
| **Cross-Site Scripting** | Unescaped output, improper encoding |
| **Access Control** | Direct file access, missing capability checks |
| **Input Validation** | Unsanitized user input, missing nonce verification |
| **Sensitive Data** | Hardcoded credentials, exposed secrets |
| **Security Misconfiguration** | Debug mode exposure, error disclosure |

## Release Requirements

### A plugin cannot be released until it passes our security scan:

- **Zero Critical Issues** - Must have no critical vulnerabilities
- **Zero High Issues** - Must have no high-severity security risks
- **Human Review** - All findings are manually reviewed for false positives

## Continuous Improvement

Our security scanner is continuously updated to catch new vulnerability patterns. We monitor WordPress security advisories, CVE databases, and emerging attack vectors to keep our detection rules current.

## Transparency

Each plugin displays a security badge linking to its scan details. We believe customers deserve to know their plugins have been security tested. Click any green "security | passed" badge on our site to see the scan summary for that plugin.

### Questions About Our Security Practices?

Contact us at [security@royalplugins.com](mailto:security@royalplugins.com)