permission_callback was optional until recently and defaulting it to __return_true is the same as having no authorisation at all, which is how endpoints intended for the admin end…
The privacy tooling that arrived in core 4.9.6 and WooCommerce 3.4 covers the standard data, and everything a custom plugin stored is yours to declare. The pagination in…
A staging database restored from production contains real addresses, and a queue worker that runs on it sends real email to real customers. It happens to everybody once.…
Managing authorized_keys across thirty servers means a configuration management run to add a colleague and another to remove one, and the removal is the one that gets forgotten.…
A queued job serialises its arguments, so a job dispatched with a customer object writes that customer’s name, email and address into the queue store — where it…
Disabling the REST API with a filter that returns an error for unauthenticated requests was a common hardening step, and on 5.0 it breaks the editor completely. The…