Security

• Editing routes check a nonce and edit_post on the content. The content API only serves published items of the Leiho content types; it can require a token (compared in constant time, sent in X-Leiho-Token). Publishing requires publish_pages (filter leiho_deploy_capability), settings require manage_options.
• The bridge is inert outside the editor iframe and checks the origin of every message, in both directions. It makes no network request.
• Values are sanitized per field type on write. required and maxlength are enforced server side. Attachments and related posts are checked for read access.
• Use a fine-grained GitHub token limited to the deployment repository (Actions: write, or Contents: write for the commit mode).

Found a vulnerability? See SECURITY.md.