HOME / SECURITY
Security & privacy by design
A plugin that watches everything and can restore anything is, by definition, security-sensitive software. FaultPilot is engineered — and documented — accordingly.
Least privilege
A dedicated capability guards every read and write — mapped to administrators, filterable per role.
Nonce everywhere
All REST routes require cookie auth plus nonce; every state change re-checks capability.
Data minimization
File paths and line numbers — not payloads. Sensitive keys are redacted recursively at capture.
No call-home
No external AI or telemetry in the request path. Nothing leaves the site by itself.
Every gate is a real gate
FaultPilot registers a dedicated management capability and wires it through the entire surface: admin screens, REST routes, recovery actions and report exports. Capabilities are checked server-side on every request — the UI hiding a button is never the security boundary.
- Capability checks on every read and every state change
- Nonce validation — REST-native, on all routes that matter
- Prepared SQL only — no dynamic table or column names from input
- Sanitize in, escape out — whitelisted REST args, escaped client output
- No code execution — no eval, no arbitrary writes outside the recovery drop-in
→ capability? ✓ manage_faultpilot
→ nonce? ✓
→ args whitelisted + sanitized ✓
→ prepared query ✓
any step fails → 403, attempt rate-counted
The high-risk surface
Recovery, designed like it matters
Recovery exists because wp-admin may be broken — which makes it the most attractive attack surface in the product. The controls are explicit.
No backdoor
The Safe Mode drop-in contains no secrets and accepts no remote commands. It does exactly two things: read one option, and filter the active plugin list. Deleting the file disables the feature — nothing else changes.
Token model
Recovery links carry a 256-bit random token. Only its HMAC-SHA256 hash — keyed with the site’s auth salt — is stored. Tokens are single-use, expire within 24 hours, and are consumed on use.
Rate limiting
Token validation is rate-limited per IP in both the runtime and the early bootstrap path. Failed attempts count against the budget; a valid token always passes and clears the counter.
Audit
Every token creation and use is written to the activity log. Recovery actions leave a trail — who generated what, when it was used, what was quarantined and restored.
The safest data is the data you never keep
Diagnostics need structure, not payloads. FaultPilot records where an error happened and what kind of error it was — not the request contents around it. Sensitive keys are redacted recursively at capture time; login failures never store usernames; recovery tokens are stored only as hashes.
And because there is no external AI call, no telemetry and no license beacon in the request path, the site’s diagnostic data stays where it belongs: on your server.
Claims
What we will and will not tell you
We say
- The security model is documented and public
- All state changes are capability + nonce checked
- Sensitive data is redacted at capture time
- Diagnostic data stays on your server
We will not claim
- Certifications we have not obtained (no GDPR badges, no SOC2/ISO claims)
- “Unhackable” or “zero vulnerability” — nothing is
- That FaultPilot replaces backups, antivirus or WAFs
- Zero-downtime guarantees during recovery
Read the full threat model
The complete security documentation covers every control in detail.