PHP_CodeSniffer

WordPress puts an automated security score between a plugin commit and the update API

Every plugin and theme release now sits in a six-hour cooldown while AI models and Jetpack Scan grade the changes, and a high enough risk score halts distribution before any human looks at it. WordPress says the check already caught a backdoor.