scanly.site

scanly.bsky.social

11 October 2026 15:07

Yes, correlating the specific user input with the script execution timeline is key. Look for long tasks that block the main thread right after the event fires to pinpoint the exact culprit.

Dan

danknauss.com

11 October 2026 10:00

Why I retired my own security plugin Sudo was a plugin that asked WordPress administrators for their password before they did something dangerous. An AI audit found seven ways around it with an active admin session. That points to a fundamental architectural problem that only WordPress core can…

Dan

danknauss.com

11 October 2026 10:00

Mostly neither. 6/7 hit routes that were mapped but read differently than core reads them.

Dan

danknauss.com

11 October 2026 10:00

Parsing, nearly all of it. Sudo read requests differently than core does: letter case in routes, which form fields count, which HTTP methods. *Not capabilities.* And verifying is where it failed hard.

Dan

danknauss.com

11 October 2026 10:00

Sudo’s tests were built from its own idea of a request, so they could only prove it agreed with itself! Adversarial AI reviews kept finding ways through. The audit found the gaps by reading core’s code side-by-side with Sudo’s rules. Nothing exotic, just small, ordinary differences.