@lunetrax

Lunetrax

@lunetraxEstoniaJoined June 2026

Notes on the security of AI-generated WordPress code.

About

Nothing here yet.

Available for

Nothing here yet.

Lunetrax's blogs

Lunetraxblog.lunetrax.com5 posts

Articles Comments

Recently published

LLunetraxblog.lunetrax.com17h ago · 18 min read

Safe by accident

The last post ended with a promise to go deeper, into the places where esc_html() is the wrong tool and code that looks escaped still leaves a hole. This is that post. It comes in two halves: first wh

LLunetraxblog.lunetrax.comJul 11 · 12 min read

So, can you stop checking AI's WordPress code?

The last experiment ended with a number and a promise. The number was thirty-two plugins with zero holes, generated from a clean slate, every line read by hand. The promise was to answer the question

LLunetraxblog.lunetrax.comJul 1 · 8 min read

I tried to prove AI writes insecure WordPress code

The question this series opened with was simple, and a little uncomfortable: when you ask an AI for WordPress code, is what it hands back safe to ship? I had a hunch. I expected to catch it red-handed

LLunetraxblog.lunetrax.comJun 27 · 5 min read

Sanitize on input, escape on output: the WordPress rule behind XSS

This is the first post in a series about the security of AI-generated WordPress code: not how people write plugins, but what a coding assistant hands back when you ask it for one, and whether that out

LLunetraxblog.lunetrax.comJun 26 · 3 min read

Before the coffee is cold

Building a solid WordPress plugin used to take real knowledge of the platform. You had to know PHP, and the small, unglamorous rules that keep a site from being broken into. Now a sentence is enough:

Lunetrax

About

Available for

Lunetrax's blogs

Recently published

Safe by accident

So, can you stop checking AI's WordPress code?

I tried to prove AI writes insecure WordPress code

Sanitize on input, escape on output: the WordPress rule behind XSS

Before the coffee is cold

Search Hashnode

Lunetrax

About

Available for

Lunetrax's blogs

Recently published

Safe by accident

So, can you stop checking AI's WordPress code?

I tried to prove AI writes insecure WordPress code

Sanitize on input, escape on output: the WordPress rule behind XSS

Before the coffee is cold