---
title: "Security · Leiho docs"
description: "How Leiho protects your site."
url: https://leiho.dev/docs/security
lang: en
updated: 2026-11-05
---
Reference

# Security

How Leiho protects your site.

- Editing routes check a nonce and `edit_post` on the content. The content API only serves published items of the Leiho content types; it can require a token (compared in constant time, sent in `X-Leiho-Token`). Publishing requires `publish_pages` (filter `leiho_deploy_capability`), settings require `manage_options`.
- The bridge is inert outside the editor iframe and checks the origin of every message, in both directions. It makes no network request.
- Values are sanitized per field type on write. `required` and `maxlength` are enforced server side. Attachments and related posts are checked for read access.
- Use a fine-grained GitHub token limited to the deployment repository (`Actions: write`, or `Contents: write` for the commit mode).

Found a vulnerability? See [SECURITY.md](https://github.com/pixelersagency/leiho/blob/main/SECURITY.md).

Updated November 5, 2026[Something unclear on this page? Tell us →](https://github.com/pixelersagency/leiho/issues/new?title=Docs%3A%20Security)