Source evidence

Safe against SQL injection & other attacks?

Wired Impact Volunteer Management · review · 2023-05-07T17:01:00+00:00

Wired Impact Volunteer Management plugin evidence original source source API

complaintsentiment

highseverity

1.0relevance

2replies

Evidence onlycommercial context

Proof Health

Open evidence

Commercial opportunities need traceable source links before they are treated as build-worthy.

1 / 1 rows with source links

100.0% of this page's analysis has direct source links.

0 build-decision rows missing links

0 rows here require auditable proof before promotion.

0 rows with no attached evidence

0 rows have source counts but still need direct links.

Conversation

review

mialopes unresolved

Hi together, I have to change the basic form from your plugin. Now I have a really important question about the security 🙂 Is your form really safe against SQL injection, attacks and so on? Regards Mia Thanks for reaching out @mialopes . We’re happy to help out, but our developer who built the plugin (and answers technical questions) is out of the office this week. I’ll be sure to circle up with him when he’s back next week and someone from our team will respond here. Thanks for your patience! Thanks a ton for being patient with me while I was out of the office Mia. To answer your question, yes, we believe our plugin is safe against SQL injections and other attacks. The most likely way an attack would happen is by providing malicious code inside the form volunteers use to express interest. For each of those fields, we immediately sanitize and clean the inputs once they make it back to the server. That way it’s not possible the information entered into the database would include malicious code. With all that said, maintaining proper security and protection for the plugin is an ongoing process and something we pay very close attention to. If a new security vulnerability pops up, our team will respond as quickly as we we can to patch it. I hope that’s helpful. Let us know if you have any other questions.

Evidence Context

Evidence only

Evidence only

This row is useful source evidence, but it has not been promoted into a build-worthy commercial opportunity.

Analysis

heuristic-v1

Summary: Safe against SQL injection & other attacks?: users show security, performance, support pain that may indicate a product gap.

Evidence quote: Hi together, I have to change the basic form from your plugin.

Affected feature: form

security performance support migration

Plugin

API

Wired Impact Volunteer Management

1.0K active installs · 59.6K downloads · rating 96.0

non-profits nonprofits not-for-profit volunteer volunteers

Comments

2 shown

David Hartstein 2023-05-09T20:18:00+00:00

Thanks for reaching out @mialopes . We’re happy to help out, but our developer who built the plugin (and answers technical questions) is out of the office this week. I’ll be sure to circle up with him when he’s back next week and someone from our team will respond here. Thanks for your patience!

Jonathan Goldford 2023-05-15T00:58:00+00:00

Thanks a ton for being patient with me while I was out of the office Mia. To answer your question, yes, we believe our plugin is safe against SQL injections and other attacks. The most likely way an attack would happen is by providing malicious code inside the form volunteers use to express interest. For each of those fields, we immediately sanitize and clean the inputs once they make it back to the server. That way it’s not possible the information entered into the database would include malicious code. With all that said, maintaining proper security and protection for the plugin is an ongoing process and something we pay very close attention to. If a new security vulnerability pops up, our team will respond as quickly as we we can to patch it. I hope that’s helpful. Let us know if you have any other questions.