=== CacheSafe for WooCommerce ===
Contributors: bananasaging
Tags: woocommerce, cache, session, cart, security
Requires at least: 6.9
Tested up to: 7.1
Requires PHP: 7.4
WC requires at least: 9.0
WC tested up to: 9.9
Stable tag: 1.0.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Prove that WooCommerce cart and customer sessions stay isolated across your real caching stack — without placing an order.

== Description ==

CacheSafe for WooCommerce is a diagnostic evidence plugin by **Cobalt Branch Labs**. It runs controlled anonymous cart sessions through your store's public WooCommerce surfaces and reports whether cache behavior, cookies, headers, and Store API responses preserve customer isolation.

https://www.youtube.com/watch?v=xplj2oDHCIc

**Free v1.0** includes manual scans, sanitized findings, provider-aware remediation guidance, WP-CLI, and local-only evidence. No telemetry, no accounts, no automatic cache changes.

= What it does =

* **Preflight checks** — WooCommerce pages, loopback reachability, Store API, test product, runner health, perspective
* **Manual staged scans** — Store API Cart-Token A/B isolation plus classic cookie/add-to-cart flow where supported
* **16 safety checks (CS-101–116)** — headers, Set-Cookie, session isolation, replay, cleanup, perspective
* **Sanitized reports** — copy or download JSON, text, or HTML without cookie values, tokens, or raw bodies
* **Provider guidance** — evidence-linked remediation for generic stacks and common cache/CDN plugins
* **WP-CLI** — `wp cachesafe preflight`, `scan`, `status`, `report`, `cancel`, `cleanup`, `purge`
* **Retention** — keeps the last five completed scans within 30 days (configurable shorter); automatic daily purge

= What it does not do =

* Place orders, process payments, or call checkout write endpoints
* Change cache, CDN, DNS, or host settings automatically
* Send telemetry or require an account
* Show a numeric "safety score"

= Admin =

WooCommerce → **CacheSafe** with tabs for Overview, Preflight, Live scan, Results, History, Settings, and Tools.

= Privacy =

All scan evidence stays on your WordPress site. CacheSafe does not phone home. Reports are sanitized to exclude cookie values, Cart-Tokens, nonces, Authorization headers, raw bodies, secrets, and customer PII. Retention is bounded and configurable; uninstall can remove plugin-owned data when enabled in Settings.

== Installation ==

1. Upload the `cachesafe-for-woocommerce` folder to `/wp-content/plugins/`, or install the ZIP via **Plugins → Add New → Upload Plugin**.
2. Activate the plugin through the Plugins screen.
3. Ensure WooCommerce is active and configure a **test product ID** under CacheSafe → Settings.
4. Run **Preflight**, then start a scan from **Live scan** or WP-CLI.

== Frequently Asked Questions ==

= Does this place test orders? =

No. CacheSafe only creates ephemeral anonymous carts using an approved simple product. It never completes checkout or captures customer PII.

= Is this a cache optimizer? =

No. It is an evidence-led auditor, not a performance plugin. It does not change cache provider settings for you.

= Does it work without WP-Cron? =

Yes. The Live scan tab advances scans while you watch; Action Scheduler is used when available but is not required for manual scans.

= How long is scan history kept? =

By default, the last five completed scans within 30 days. Failed or cancelled scans are purged sooner. You can purge manually from Tools or WP-CLI.

= Will this slow down my storefront? =

Scans are admin-triggered and budget-limited (default ≤30 HTTP requests, short timeouts). They are not continuous background traffic.

= Where can I get support? =

Use the WordPress.org support forum for this plugin after it is published, or contact Cobalt Branch Labs through the Author URI listed on the plugin page.

== Screenshots ==

1. CacheSafe overview and scan summary
2. Live scan progress with stage timeline
3. Findings with sanitized evidence drawer

== Development ==

Unminified JavaScript and CSS live in `assets/src/`. Built admin assets are written to `assets/build/` via `@wordpress/scripts`.

To regenerate the compiled files from this plugin directory:

1. `npm install`
2. `npm run build`

`package.json` and `webpack.config.js` ship with the plugin so the build can be reproduced without a separate repository.

== Changelog ==

= 1.0.1 =
* Ship unminified `assets/src` plus build tooling in the distributable package for Guideline 4 source access
* List WordPress.org username bananasaging in Contributors

= 1.0.0 =
* Free v1.0 release: full manual scan pipeline, 16 checks, admin UI, WP-CLI, sanitized reports
* Store API and classic cookie A/B session isolation in live scans
* Automatic retention purge (daily cron + after scan completion)
* Provider-aware remediation catalog (Cloudflare, LiteSpeed, WP Rocket, WP Super Cache, W3 Total Cache, host-cache)
* Request-budget accounting and duplicate-finding fixes for live polling

= 0.1.0-alpha.0 =
* Early lab scaffold and quality toolchain

== Upgrade Notice ==

= 1.0.1 =
Includes unminified front-end source and build tooling in the plugin package for public source access.

= 1.0.0 =
First public free release with complete manual scan workflow. Review Settings for test product ID before scanning.
