The addon is a local WordPress integration. It does not phone home, does not register a public REST route, and does not store Uncanny or Stripe API keys.
Documented behavior reflects addon v1.2.0.
Trust boundary
Section titled “Trust boundary”| Control | Implementation |
|---|---|
| Direct file access | ABSPATH (or WP_UNINSTALL_PLUGIN) on every PHP file |
| Recipe trust | Actions require a published Automator recipe (uo-recipe / uw_recipe) |
| Capabilities | Settings page: manage_options. AJAX template meta: Automator ajax_auth_check() |
| Input | Emails, titles, IDs, statuses, channels, and prefill maps are sanitized before WPsigner APIs run |
| Prefill | Max 40 keys; values sanitize_text_field, 500 characters; signature-like types skipped |
Draft recipes cannot create or send documents.
URLs and secrets
Section titled “URLs and secrets”| Data | How it is exposed |
|---|---|
| Signing URL | WPsigner Signer::get_signing_url only. Optional via settings / wpsua_include_signing_url |
| Download URL | Document::get_secure_download_url after sign/complete. Never a homemade token |
| Cloud URL | Existing https share/view URL or backup option. No local file_path |
| Slack / WhatsApp | Uses credentials already stored by WPsigner messaging integrations |
| Payment intent ID | Stripe ID string only |
Rate limits
Section titled “Rate limits”| Action | Window |
|---|---|
| Send, remind, channel remind | 20 seconds per document (and channel) |
| Slack custom message | 20 seconds global |
| Create from template | Hourly cap (default 60) |
Limits are transients, not a permanent lockout. They exist so a looping recipe cannot mail-bomb signers.
Template source map
Section titled “Template source map”Option wpsua_document_sources maps document ID → template ID so triggers can filter by template. The map is capped (wpsua_source_map_max, default 2000, oldest entries dropped). It does not contain PDFs or signing tokens.
admin-ajax.php action wpsua_get_template_meta (and automator_wpsua_get_template_meta) returns required signer slots and fillable field labels for the recipe builder. It does not return signing URLs or field values. Auth is Automator’s recipe-builder check, with a manage_options / edit_posts fallback if Automator is unavailable.
Uninstall
Section titled “Uninstall”uninstall.php runs only when this plugin is the one being removed. It deletes:
wpsua_document_sourceswpsua_settings- Transients whose names start with
wpsua_
It does not delete WPsigner documents, signers, Automator recipes, or logs.
Trademark and data sharing
Section titled “Trademark and data sharing”WPsigner for Uncanny Automator is not affiliated with Uncanny Owl. Installing it does not send site data to Uncanny or to WPsigner.