Contentrain Bridge 0.7.1

• A request made with a Contentrain Migrate connection key no longer runs as the administrator who created the key. It runs with no WordPress user at all; the key stays valid only while that administrator still has the export and manage_options capabilities, and the exports it starts are recorded in the plugin's own settings, never in a user's profile. A key can no longer reuse or replace an export the administrator started with an application password. Revoking the key also removes the exports it prepared. Nothing changes for Contentrain Migrate: every route, answer and error code is as before.
• The Bridge screen, this readme and the privacy-policy text now say what the key lets Migrate read, that it cannot change the site, and how to revoke it.
• The export screen sends its requests as plain form fields, each checked on its own, instead of one JSON blob; the REST export routes declare and check every parameter; the note about a server that does not read .htaccess names the kind of server (nginx, IIS, other) instead of repeating the server header. A coding-standards check (PHP_CodeSniffer with the WordPress ruleset) now runs in the plugin's own tests.

Install: download contentrain-bridge.zip below, then Plugins > Add New > Upload Plugin. Updating: upload the new ZIP over the installed plugin.