To help the Plugin Review team make the most of their contribution time and improve the security of all plugins distributed on WordPress.org, Meta team contributors have built a code scanner that detects potential security risks such as unescaped SQL queries in plugin code. This is installed as a plugin on WordPress.org, and displays results in a metabox on the plugin edit screen accessible to reviewers.
The Plugin Review team has been sharing feedback on the quality of the results, which has let Meta contributors to refine the tool to improve the noise-to-signal ratio that makes any automated checker a challenge.
Looking forward, our teams are discussing how often to run this scan (probably every time a new version of a plugin is detected), and how to semi-automate informing plugin authors about the results of the scans.
We’re excited that the Plugin Review team finds this tool useful, and that we’re making progress toward one of our Big Picture Goals for 2021 by decreasing manual work for contributor teams through better tooling.
If you’re a plugin developer and would like to help test the scanner on your own code, it’s available on GitHub.
Many thanks to the Plugin Review team for making the time to test and share the feedback that made this tooling improvement possible!