Security and privacy

Reading the roadmap is public. Voting, feedback, and idea submission require an authenticated session and REST nonce. Feedback is plain text, length-bounded, rate-limited, duplicate-protected, and pending moderation by default. Idea submissions are length-bounded, rate-limited, and stored as pending posts. Public API responses do not expose voter identities, submitter identities, or email addresses.

Roadmap item detail HTML is rendered through WordPress content filters and reduced to the elements and attributes allowed by wp_kses_post before the portable reader inserts it. A plain-text form is also returned for non-HTML adapters. Customer-authored feedback and idea submissions are never rendered through this public rich-content path unless staff reviews and publishes them as roadmap items.

Vote and feedback endpoints fail closed when WordPress cannot persist their records; the client never reports a successful mutation after a rejected database write.

One-vote enforcement uses an atomic per-account lock before comment persistence, closing the concurrent check-then-insert race. A failed database write releases the lock so a legitimate retry remains possible. Broader per-account vote limits reduce automated traversal abuse without changing the public vote count.

Roadmap staff email is disabled by default. Messages intentionally omit submitted feedback and idea bodies. Delivery audit rows contain only event, outcome, and time; they never store recipient addresses or customer content.

Roadmap decisions remain administrator-controlled: vote counts are product input, not an automatic commitment or scheduling authority.

Public progress history contains only the previous state, new state, and transition time. Staff identities and private explanations are deliberately excluded, malformed stored entries are discarded, and history is bounded to 25 transitions per item.