Gateway Fee Exporter Documentation

    Security Audit

    Documentation for WebMe Gateway Fee Exporter.

    Security Audit Report

    Generated by webme-security-auditor.

    Gate

    PASS WITH REVIEW: no active blocker/high findings.

    Summary

    • Blockers: 0
    • Highs: 0
    • Mediums: 0
    • Waivers: 2

    Findings

    No active findings.

    Waivers

    • includes/Export/CsvExporter.php:103:file-operation-needs-path-review:ae26fa48f1 expires 2026-08-31: CSV export writes through an in-memory SplTempFileObject after admin-post nonce and manage_woocommerce checks; no user-controlled filesystem path is accepted.
    • includes/Admin/PresetController.php:1:request-output-needs-escape-review:c28feff291 expires 2026-08-31: Preset actions read POST data only after nonce/capability checks, sanitize stored values, and redirect without rendering request data.

    Next Steps

    Review blocker/high findings first. Classify reviewRequired findings after reading exact files.