Compatibility: bumped the “Tested up to” header to WordPress 7.0.
Quality: added a languages folder with a kafene.pot translation template so the Domain Path header resolves to an existing folder.
Quality: removed debug logging from production paths and guarded the remaining diagnostic logs behind WP_DEBUG.
i18n: moved HTML out of translatable admin-notice strings so only the message text is translated.
1.0.3
Security: Kafene bearer token is no longer exposed in the page-level frontend configuration. It is now minted on demand by a nonce-guarded AJAX endpoint (order ownership + order-key + Kafene payment-method gate) and injected into the SDK via kafene.overrideConfig() immediately before kafene.checkout.load(), keeping the credential off non-checkout views and out of view-source.
Security: enforced timestamp validation on incoming webhooks with a 5-minute TTL to prevent replay attacks.
Security: added order ownership and order-key validation across AJAX endpoints and the checkout bootstrap redirect.
Compatibility: added support for the WooCommerce Checkout block alongside the classic checkout shortcode.
Compatibility: added the Requires Plugins: woocommerce header (WordPress 6.5 and later) for a cleaner dependency message.
Quality: enqueued scripts now use the plugin version constant for cache busting.
Quality: switched the WooCommerce activation check to a multisite-safe pattern using is_plugin_active and is_plugin_active_for_network.
