diff --git a/SECURITY_TASKS.md b/SECURITY_TASKS.md new file mode 100644 index 0000000..4d16b62 --- /dev/null +++ b/SECURITY_TASKS.md @@ -0,0 +1,106 @@ +# ATT Consent — Security & Standards Audit + +Audit date: 2026-02-18 + +## Summary + +| Severity | Count | Status | +|----------|-------|--------| +| Critical | 0 | — | +| High | 2 | Documented (by-design / future consideration) | +| Medium | 4 | Fix in progress | +| Low | 7 | Fix in progress (priority items) | + +--- + +## High Severity + +### H1. Admin Script Snippets Rendered Raw to Frontend + +**File:** `includes/class-scripts-manager.php:106`, `includes/class-frontend.php:178,185` +**Status:** By design — no action required +**Detail:** The `snippet` field is stored raw and rendered to all visitors. This is the standard WordPress pattern for code-injection features (Theme Editor, HFCM). Protected by `manage_options` capability + nonce verification on save. + +### H2. Inline Scripts Incompatible with CSP + +**File:** `includes/class-frontend.php:68-127` +**Status:** Future consideration +**Detail:** The consent defaults and tracking scripts are output as raw inline `