# Plattio Forms security model

Plattio Forms applies WordPress secure-development conventions and defense in depth to public submissions, privileged administrator actions, file handling, and generated documents. The detailed 2.0.9 review and frontend asset matrix are documented in `SECURITY-AUDIT-2.0.9.md`.

## Public submissions

- Per-form WordPress nonce validation and published-form verification.
- Signed form-render timestamp with a configurable minimum completion time.
- Honeypot protection enabled by default.
- Configurable per-form rate limiting based on a one-way keyed hash of the observed client address.
- Server-side allowlist validation for every supported field type.
- Central upload policy with blocked active content, WordPress-supported MIME allowlisting, real-upload checks, content-aware extension/MIME verification, and server-side size limits.
- Prepared database queries and contextually escaped output.
- Uploaded files are removed when entry storage is disabled after synchronous notifications and extension hooks have run.

## Administrator actions

- Custom capabilities for form management and entry access.
- WordPress nonces on create/update/delete, import/export, settings, module, licensing, email, PDF, and entry actions.
- Imported schemas are sanitized and bounded by form, field, and choice limits.
- Existing non-form posts cannot be converted by manipulating a form ID.
- CSV cells that could be interpreted as spreadsheet formulas are prefixed safely.

## Privacy defaults

- IP address storage is disabled by default.
- User-agent storage is disabled by default.
- Entry storage can be disabled per form.
- Retention cleanup, WordPress personal-data export/erasure, and uninstall deletion controls are included.

## Protected files

Digital signatures accept only validated PNG data URLs within strict byte and dimension limits. Files receive random names, are stored under a non-listable plugin-controlled directory, and are served through a 256-bit bearer token. PDF access supports token, authenticated-user, entry-owner, role, and password policies. Password-protected PDF access is nonce-protected and throttled per client and per document token.

Standard file fields use WordPress Media Library attachments and follow the site's media access policy. Administrators should allow only the document types required by the form.

Security reports should be submitted through the contact channel at https://plattio.no/ and should not include sensitive production data.
## AI Form Agent

The optional AI Form Agent uses fixed OpenAI and Anthropic endpoints, encrypted bring-your-own API keys, capability and nonce checks, per-user throttling, bounded conversation input, strict structured output, server-side blueprint validation, and reduced non-secret form context. It is never loaded on public frontend requests. See `AI-AGENT.md` for the complete data-flow and threat-control summary.

