Security & Quality

Security checks for code you can trust

SitePulse Pro is developed with seven complementary security tools. This page explains the automated checks configured for the project and what each one is designed to catch.

Start 14-Day Pro Trial See the 7 tools
Security & Quality

Seven tools in the project workflow

A compact evidence board for the tools configured in the project workflow. Findings are reviewed as part of the release process.

  • PHP_CodeSniffer

    PHP_CodeSniffer

    Checks STATIC ANALYSIS

    WordPress Security Sniffs

    WPCS reports escaping, nonce verification, prepared SQL, and direct database access issues.

    Learn more
  • PHPStan

    PHPStan

    Checks STATIC ANALYSIS

    Type Safety Analysis

    Static analysis at level 5 reports undefined methods, wrong argument types, and dead code.

    Learn more
  • Psalm

    Psalm

    Checks DATA FLOW

    Taint Analysis

    Tracks user input from entry to output. Flags XSS, SQLi, SSRF, command injection paths.

    Learn more
  • Composer Audit

    Composer Audit

    Checks DEPENDENCIES

    Dependency CVEs

    Composer dependencies are checked early in the automated workflow for known vulnerabilities.

    Learn more
  • Snyk

    Snyk

    Checks DEPENDENCIES + CODE

    Open Source + Code SAST

    When configured, scans transitive dependencies and our code for security issues.

    Learn more
  • Aikido Security

    Aikido Security

    Checks SAST + DEPENDENCIES

    SAST + Dependency

    When configured, combines SAST and dependency findings for security review.

    Learn more
  • OpenAI Codex

    OpenAI Codex

    Checks PULL REQUEST REVIEW

    AI Code Review

    When configured, reviews pull requests for SQLi, XSS, CSRF, missing nonces, and capability checks.

    Learn more
How the pipeline runs

One workflow. Eight security checks.

Seven tools contribute eight configured checks; Snyk supplies separate dependency and code scans. Results are reviewed as part of the release process.

  1. Check

    Composer Audit

    Dependencies in composer.lock are checked early in the automated workflow against the FriendsOfPHP security database.

  2. Check

    PHPCS + WPCS

    WordPress-Extra ruleset reports unescaped output, missing nonces, unprepared SQL, and direct DB calls.

  3. Check

    PHPStan

    Static type analysis with the WordPress extension reports undefined methods, wrong argument types, and dead code at level 5.

  4. Check

    Psalm Taint

    Taint analysis tracks user input from entry to output and flags XSS, SQLi, SSRF, and command injection paths.

  5. Check

    Snyk Open Source

    When configured, independent vulnerability intelligence scans transitive dependencies and reports high-severity CVEs.

  6. Check

    Snyk Code SAST

    When configured, static application security testing scans our code for injection, hard-coded secrets, and weak cryptography.

  7. Check

    Aikido Security

    When configured, independent SAST and dependency scans report critical-severity findings for review.

  8. Check

    OpenAI Codex Review

    When configured, pull requests receive an AI security review for SQLi, XSS, CSRF, missing nonces, and capability checks.

Supply chain

Pinned, locked, and audited

Composer dependencies are locked in composer.lock and checked by the automated workflow. Dependency findings are surfaced for review before release.

Release process

  1. Changes to SitePulse code trigger the automated security workflow.
  2. Pull requests can receive an AI security review when the integration is configured.
  3. Workflow reports and scan artifacts are retained for review.
  4. Security findings are reviewed before a release is approved.
Vulnerability disclosure

Found a security issue? Tell us first.

We take every report seriously. Responsible disclosure gives us a chance to fix the issue before public disclosure, and we credit researchers who follow the policy.

Report to: hello@sitepulse.me

Include reproduction steps, affected versions, and any proof-of-concept code. Expect an initial response within 48 hours.

Please do not file public issues for security bugs. Email us directly so we can patch before the vulnerability becomes public.

Built secure from day one

Seven complementary tools contribute eight configured checks to our security review process. Try SitePulse Pro with the same code we ship to production.

Start 14-Day Pro Trial Ask us anything