Back to bossyplugins.com

Security Policy

Bossy makes bulk writes to your WooCommerce database. That's a serious responsibility. Here's exactly how we protect your store and your data.

Database Security

Every database operation in Bossy's plugin-owned code uses WordPress's prepared statement API. Specifically:

• All direct queries use $wpdb->prepare() with typed placeholders
• Integer values are normalized via absint() or cast before use
• LIKE search values are escaped with $wpdb->esc_like() before binding
• All inserts use $wpdb->insert() with format arrays — no raw query building
• There is no raw $wpdb->query() with concatenated user input in plugin-owned code

Authentication & Authorization

Bossy enforces authentication and capability checks on every sensitive operation:

• All AJAX endpoints verify a nonce via check_ajax_referer('bossy_nonce', 'nonce')
• Admin form submissions use check_admin_referer()
• Capability checks are enforced before any data write: edit_products, edit_post, delete_post
• Object-level checks confirm the user can edit the specific post before modifying it
• Bossy registers no wp_ajax_nopriv_* routes — all endpoints require a logged-in user

Destructive Actions

Danger Zone operations — bulk product deletion and product-linked image removal — require multiple layers of confirmation before executing:

• Nonce verification on submission
• Capability enforcement (delete_post)
• Typed confirmation string that the user must enter explicitly

There is no single-click path to irreversible data loss in Bossy. Snapshot Undo captures before-state on every significant write, providing a recovery path even if an action was unintentional.

Input Handling

All user-supplied input is treated as data, never as SQL structure or executable code:

• Form fields are sanitized with sanitize_text_field(), sanitize_email(), or appropriate typed casts before use
• Output is escaped with esc_html(), esc_attr(), or esc_url() at the point of rendering
• Customer personalization input enforces a server-side character limit via the bossy_customer_input_max_length filter — not just a frontend maxlength attribute

Import & External Requests

The CSV Importer's background image queue fetches images from external URLs. To protect your server:

• Image import sessions are scoped to the uploading admin user via transients
• Background media runner arguments are bound to the initiating user — not globally accessible
• No sensitive tokens or session data are passed in URL parameters or query strings
• SSRF protections are documented in the plugin FAQ and configurable via a filter for environments with strict outbound policies

Supply Chain

• Composer audit: no advisories in production dependencies at launch
• NPM audit: moderate advisories exist in dev tooling only (@wordpress/env dependency chain) — node_modules is excluded from the distribution ZIP via .distignore and is never shipped to production
• The Freemius SDK is bundled as the licensing layer. Its distribution is scoped to admin contexts only.

Testing & Audit History

• Security reviews were conducted at multiple stages of development — not as a single end-of-cycle audit
• Every DB-touching function was enumerated and verified against prepared statement, sanitization, capability, and nonce patterns
• PHP syntax checks, PHPUnit unit tests, and Playwright E2E tests run as a release gate before every version ships
• WordPress.org Plugin Check passed on May 11, 2026
• 64/64 tests passing across WP 6.9 and WP 7.0 at launch

Versioning & Updates

Security fixes are patched and released as quickly as possible. Version history is tracked in the public changelog. Users on auto-update or manual update schedules are encouraged to stay current.