EngageDock AI – Smart Support Assistant Security & Risk Analysis

The engagedock-ai-smart-support-assistant plugin v1.0.0 exhibits a generally strong security posture based on static analysis. The complete absence of dangerous functions, 100% output escaping, and a high percentage of prepared SQL statements are commendable practices. The lack of any recorded vulnerabilities or CVEs in its history further suggests a well-maintained and secure codebase. However, a significant concern arises from the presence of four unprotected REST API routes. This creates a direct attack vector that could be exploited if these routes handle sensitive data or actions without proper authentication or authorization checks.

While the plugin demonstrates good development hygiene in many areas, these unprotected REST API endpoints represent a tangible risk. The limited number of file operations and external HTTP requests, along with the presence of nonce and capability checks on many entry points, are positive indicators. Nevertheless, the critical nature of unauthenticated access points cannot be overstated. The current score reflects these strengths alongside the identified weaknesses, with the unprotected REST API routes being the primary area of concern.