Reference

Security Guidelines & Submission Standards

All packages submitted to the AIPostify Marketplace undergo automated static analysis scanning and ClamAV malware checks before reaching human moderation.

🚫 Forbidden Functions & Code Patterns

Submissions containing any of the following patterns will be automatically blocked by SecurityScannerService:

Dynamic code evaluation: eval(), create_function()
System execution: exec(), shell_exec(), system(), passthru(), popen(), proc_open()
Base64 dynamic execution: base64_decode combined with eval
Obfuscated payload strings or unreadable packed JavaScript

Security Best Practices

1. Sanitization & Escaping

Always sanitize user input before storing or rendering. Use Blade escaping {{ $variable }} rather than raw {!! $variable !!} unless rendering trusted HTML.

2. Database Security

Use Eloquent or Query Builder bindings for all database operations. Never concatenate unescaped input into raw SQL queries.

3. Authorization Checks

Check user capabilities before processing admin actions or settings updates using user_can() or middleware.

4. Webhook & Public Endpoint Authentication

When registering unauthenticated webhook endpoints using Hook::listen('plugin_ajax_{action}', ..., requiresAuth: false), your callback must verify the request's authenticity itself (via HMAC signatures, shared secrets, or provider tokens). AIPostify does not verify unauthenticated public webhooks for you. Unprotected public endpoints that process unverified input will be rejected during marketplace moderation. See AJAX & Webhook Handlers.