# 3mpStudio ALT Finder Security Notes

Version 1.0.2 uses WordPress-native security controls for all ALT-text changes:

- WordPress capability gate (`upload_files`).
- Object-level authorization (`edit_post`) for every attachment before a write.
- WordPress nonce validation for CSRF protection.
- POST-only save requests.
- Attachment type and image validation before writes.
- Sanitized user input and context-appropriate output escaping.
- Allowlisted view and error states.
- Safe WordPress admin redirects assembled by the plugin rather than accepting arbitrary redirect URLs.
- Maximum ALT-text input length of 1,000 characters.
- No public AJAX endpoint, REST route, remote code retrieval, executable file write, or telemetry.
- Direct PHP access is blocked when WordPress is not loaded.

No plugin can guarantee the security or accessibility of an entire WordPress site. Both depend on WordPress core, themes, plugins, hosting, server configuration, credentials, content, and timely updates.

Please report plugin-specific security issues privately through https://3mpstudio.com/ rather than publicly disclosing an unpatched vulnerability.