# WP Guard — Sources

Central bibliography. Operational guidance lives in the other references; read this file only when a source URL is needed.

## Contents

- WordPress handbooks and standards
- Research on AI-generated code defects

## WordPress handbooks and standards

- Plugin Handbook — Security: https://developer.wordpress.org/plugins/security/
- Common APIs Handbook — Sanitizing Data: https://developer.wordpress.org/apis/security/sanitizing/
- Common APIs Handbook — Escaping Data: https://developer.wordpress.org/apis/security/escaping/
- Nonces: https://developer.wordpress.org/apis/security/nonces/
- WordPress Coding Standards (WPCS ruleset): https://github.com/WordPress/WordPress-Coding-Standards
- Plugin Handbook — Internationalization: https://developer.wordpress.org/plugins/internationalization/
- wpdb::prepare() reference: https://developer.wordpress.org/reference/classes/wpdb/prepare/
- REST API Handbook — Adding Custom Endpoints: https://developer.wordpress.org/rest-api/extending-the-rest-api/adding-custom-endpoints/
- Options autoloading (WP 6.6+): https://make.wordpress.org/core/2024/06/18/options-api-disabling-autoload-for-large-options/
- Script loading strategies (WP 6.3+): https://make.wordpress.org/core/2023/07/14/registering-scripts-with-async-and-defer-attributes-in-wordpress-6-3/

## Research on AI-generated code defects

- Veracode, 2025 GenAI Code Security Report — 45% of AI-generated samples contained OWASP Top 10 vulnerabilities; XSS failed in 86% of XSS-prone tasks: https://www.veracode.com/resources/analyst-reports/2025-genai-code-security-report/
- Perry et al., "Do Users Write More Insecure Code with AI Assistants?", ACM CCS 2023: https://arxiv.org/abs/2211.03622
- GitGuardian, State of Secrets Sprawl 2025 — 40% higher secret-leak incidence in Copilot-active repos: https://www.gitguardian.com/state-of-secrets-sprawl-report-2025