<?xml version="1.0"?>
<ruleset name="WordPress-Plugin">
  <description>PHP_CodeSniffer rules for my WordPress plugin</description>

  <!-- Scan only plugin files -->
  <file>./</file>
  <exclude-pattern>vendor/*</exclude-pattern>
  <exclude-pattern>node_modules/*</exclude-pattern>
  <exclude-pattern>tests/*</exclude-pattern>

  <!-- Base rules -->
  <rule ref="WordPress"/>

  <!-- Require escaping for all output -->
  <rule ref="WordPress.Security.EscapeOutput"/>

  <!-- Require sanitization for input -->
  <rule ref="WordPress.Security.ValidatedSanitizedInput"/>

  <!-- Allow long arrays for backwards compatibility -->
  <rule ref="Generic.Arrays.DisallowShortArraySyntax"/>
</ruleset>
