# Internal security review — 4.4.2

Scope: PHP/JavaScript application code excluding upstream WordPress/Freemius/vendor code. This is a maintainer review and automated release gate, not an independent third-party attestation.

## Reviewed controls

- Admin writes require capabilities and CSRF nonces; public mutations use nonces/tokens plus rate limits.
- Customer management links and staff sessions are server-validated; sensitive settings are encrypted/redacted in diagnostics.
- REST routes declare permission callbacks. Square webhooks fail closed without a signature key and use constant-time signature comparison.
- Uploads are rate-limited, size/MIME checked through WordPress upload handling, tied to upload-enabled services, and attachment IDs are revalidated before booking.
- SQL identifiers are plugin-owned; external values use prepared queries or WordPress database helpers.
- Booking/service changes are revalidated at commit time for availability, qualifications, business hours, breaks and conflicts.
- Square writes use idempotency/version guards; duplicate webhooks are ignored and transient failures are retried.

Automated gates: PHP syntax, JavaScript syntax, static public-surface controls, translation placeholders, booking/browser regressions, Square resilience assertions, scale/index checks and package-root validation.

Residual risks: compromised WordPress administrators/hosting, unsupported third-party code, provider outages, misconfigured mail/cron/cache, and the unavoidable gap between payment and booking provider transactions. Commission/profit reports are operational estimates, not accounting statements.