v1.1.0

Security Hardening Release

This release addresses security recommendations from a comprehensive audit and significantly improves credential handling.

Security Improvements

• Encrypted Credential Storage: AWS access keys and secret keys are now encrypted using AES-256-CBC before being stored in the database
• Environment Variable Support: Credentials can now be set via CLOUDFRONT_AWS_ACCESS_KEY and CLOUDFRONT_AWS_SECRET_KEY environment variables or wp-config.php constants
• No Credential Exposure in HTML: Credentials are no longer output in hidden form fields - existing credentials show as masked placeholders
• HTTPS Enforcement: Settings page displays a warning on HTTP connections and blocks credential submission over insecure connections
• Explicit Capability Check: Added defense-in-depth capability check at the start of the settings page
• Configurable Logging: Replaced error_log() calls with WordPress action hooks (notglossy_cloudfront_invalidation_sent and notglossy_cloudfront_invalidation_error) for flexible logging

Migration

Existing plaintext credentials will be automatically migrated to encrypted storage on first load.

Development

• Added PHPCS configuration for WordPress coding standards
• Added composer scripts: composer phpcs and composer phpcbf

Full Changelog: v1.0.1...v1.1.0