Fixed plugin Tags: “wordpress” and “plugin” are banned/disallowed tags on WordPress.org and were being ignored; the remaining list also exceeded the 5-tag limit. Replaced with 5 valid, relevant tags.
Corrected Stable tag/Version, which had drifted to a stale “1.3” (actual last release was 1.3.6.1) — readme.txt and the plugin header just hadn’t been kept in sync with the real release tags.
Removed the hardcoded DFMHSLL_VERSION duplicate; it’s now read from the plugin header at runtime. Also removed a dead line in the deploy workflow that tried to patch a differently-named constant that never existed in this codebase.
1.3
Security: fixed SQL injection in the live lookup endpoint (queries now use $wpdb->prepare()).
Security: the auth key is now compared in constant time with hash_equals().
Security: added nonce (CSRF) protection and capability checks to the settings and support ticket forms.
Security: escaped all admin output (esc_attr/esc_html/esc_url), including the remotely fetched plugins list.
Bugfix: the support ticket form no longer triggers a fatal error (removed the undefined softsdev_notice() call).
Bugfix: the last name search now returns matches (it previously queried the wrong meta join).
