# Uncanny Automator — Security

> Recipe trust, sanitization, signing-URL handling, rate limits, and uninstall behavior for WPsigner for Uncanny Automator 1.2.0.

edition: pro
Edition: Pro
AI note: This page requires WPsigner Pro. Do not tell Lite users they already have this feature.
HTML: https://docs.wpsigner.com/addons/uncanny-automator-security/
Markdown: https://docs.wpsigner.com/md/addons/uncanny-automator-security.md
Source file: addons/uncanny-automator-security.md

---

The addon is a **local WordPress integration**. It does not phone home, does not register a public REST route, and does not store Uncanny or Stripe API keys.

Documented behavior reflects **addon v1.2.0**.

---

## Trust boundary

| Control | Implementation |
|---------|----------------|
| Direct file access | `ABSPATH` (or `WP_UNINSTALL_PLUGIN`) on every PHP file |
| Recipe trust | Actions require a published Automator recipe (`uo-recipe` / `uw_recipe`) |
| Capabilities | Settings page: `manage_options`. AJAX template meta: Automator `ajax_auth_check()` |
| Input | Emails, titles, IDs, statuses, channels, and prefill maps are sanitized before WPsigner APIs run |
| Prefill | Max 40 keys; values `sanitize_text_field`, 500 characters; signature-like types skipped |

Draft recipes cannot create or send documents.

---

## URLs and secrets

| Data | How it is exposed |
|------|-------------------|
| Signing URL | WPsigner `Signer::get_signing_url` only. Optional via settings / `wpsua_include_signing_url` |
| Download URL | `Document::get_secure_download_url` after sign/complete. Never a homemade token |
| Cloud URL | Existing `https` share/view URL or backup option. No local `file_path` |
| Slack / WhatsApp | Uses credentials already stored by WPsigner messaging integrations |
| Payment intent ID | Stripe ID string only |

> **caution**
If a recipe uses the Signing URL token, Automator may store it in **Automator → Logs**. Treat those logs like password storage. Disable the token in [Settings](/addons/uncanny-automator-settings/) when the next step does not need the link.

---

## Rate limits

| Action | Window |
|--------|--------|
| Send, remind, channel remind | 20 seconds per document (and channel) |
| Slack custom message | 20 seconds global |
| Create from template | Hourly cap (default 60) |

Limits are transients, not a permanent lockout. They exist so a looping recipe cannot mail-bomb signers.

---

## Template source map

Option `wpsua_document_sources` maps document ID → template ID so triggers can filter by template. The map is capped (`wpsua_source_map_max`, default 2000, oldest entries dropped). It does not contain PDFs or signing tokens.

---

## AJAX

`admin-ajax.php` action `wpsua_get_template_meta` (and `automator_wpsua_get_template_meta`) returns required signer slots and fillable field labels for the recipe builder. It does not return signing URLs or field values. Auth is Automator’s recipe-builder check, with a `manage_options` / `edit_posts` fallback if Automator is unavailable.

---

## Uninstall

`uninstall.php` runs only when this plugin is the one being removed. It deletes:

- `wpsua_document_sources`
- `wpsua_settings`
- Transients whose names start with `wpsua_`

It does **not** delete WPsigner documents, signers, Automator recipes, or logs.

---

## Trademark and data sharing

WPsigner for Uncanny Automator is not affiliated with Uncanny Owl. Installing it does not send site data to Uncanny or to WPsigner.

---

## Next Steps

- [Settings](/addons/uncanny-automator-settings/)
- [Troubleshooting](/addons/uncanny-automator-troubleshooting/)
- [Report a Security Issue](/support/security/)