Folderly Security & Risk Analysis

The 'folderly' plugin version 0.3.2 exhibits a generally positive security posture based on static analysis. The absence of any identified attack surface entry points, dangerous functions, file operations, or external HTTP requests is a strong indicator of secure coding practices. Furthermore, the excellent output escaping practices (100% properly escaped) and a high percentage of SQL queries using prepared statements (67%) suggest a commitment to preventing common web vulnerabilities. The taint analysis also found no flows with unsanitized paths, which is highly encouraging.

However, the plugin's vulnerability history presents a notable concern. The presence of one known medium-severity vulnerability, specifically an 'Incorrect Authorization' type, and its recent discovery (2025-10-31) suggests a potential recurring weakness in access control mechanisms. While this vulnerability is currently patched, it highlights an area where diligent review and testing are crucial. The lack of nonce checks across the plugin is also a potential area for improvement, although this is mitigated by the very low overall attack surface reported.