API reference

Security model

Understand the trust boundaries and the responsibilities that remain in theme templates.

#Input protection

Option writes are allow-listed by page and field.
Post meta uses type-specific sanitizers and REST schemas.
Post writes require permission for the exact post.
Option pages require their configured capability.
Template paths must resolve to approved PHP files.

#Output escaping is your responsibility

Sanitizing stored data does not replace context-aware output escaping. Escape at the last possible moment in PHP templates.

<a href="<?= esc_url($url) ?>" data-label="<?= esc_attr($label) ?>">
    <?= esc_html($label) ?>
</a>

#Caching security

Cached HTML can cross user requests when persistent object caching is enabled. Never cache output containing nonces, private data, account state, or cart/session content.

#Privacy and outbound requests

Voxycure Framework contains no telemetry client and sends no activation, deactivation, update, usage, site URL, content, field, block, or option data to Voxycure. Plugin activation only creates a short-lived local transient so WordPress can refresh rewrite rules once.