dokan-code-review

To review a Dokan pull request for security and coding standards, audit PHP code for REST endpoint permission callbacks, input sanitization, output escaping, and proper hook prefixes. It enforces architectural consistency by requiring REST controllers to extend Dokan base controllers and use prepare_item_for_response.

Security practices for WordPress REST API endpoints in Dokan require permission callbacks on all routes, sanitizing inputs, escaping outputs, and using prepared statements for dynamic SQL. The code review process identifies missing security callbacks and verifies proper data sanitization across Dokan domains.

Enforce PHP naming conventions in Dokan code by checking for snake_case methods and variables, proper namespaces under WeDevs\Dokan, and the dokan-lite text domain. The review also ensures a dokan_ prefix on all hooks and requires @since tags with PHPDoc on methods, hooks, and filters.

Dokan code review does not allow REST controllers to extend WP_REST_Controller directly. Architecture and structure rules mandate that REST controllers must extend Dokan base controllers and implement prepare_item_for_response to maintain architectural consistency across the plugin.

You need a code audit for Dokan plugin changes when reviewing pull requests, performing code quality checks, or verifying architectural compliance. It identifies missing PHPDoc, improper naming conventions, and security vulnerabilities like unsanitized inputs or missing permission callbacks in PHP backend code.