#40
Noah Okoye
WP Taverm Jukebox with Alex Harlan
Episode
#40 – Noah Okoye on What Plugin Security Reviews Actually Catch
Noah Okoye walks through a week in plugin review: the bugs that are boring, the ones that are dangerous, and why a 2,000-line readme is not a security policy.
by Alex Harlan·June 17, 2026·with Noah Okoye
Listen
Search for WP Taverm in your podcast player, or copy the feed URL:
https://wptaverm.com/feed/podcast/Noah Okoye reads plugin zips for a living. He is not hunting clever zero-days so much as the ordinary kind: unsanitized options, update endpoints that trust a query string, and admin AJAX that forgot a nonce.
We talk about the review queue, the difference between a CVE and a bad habit, and why authors who paste a “security” marketing bullet rarely survive a five-minute audit.
If you ship plugins, this episode is a checklist disguised as a conversation. Bring a notepad. Leave the buzzwords at the door.
