linchpin / psst

Pretty Secure Secret Transmissions. WordPress plugin to share encrypted expiring posts. This plugin is inspired by the great onetimesecret.com though it does not share any codebase

Psst Documentation

Pretty Secure Secret Transactions

This plugin is gives visitors a way to create one time secrets that expire after viewing.

How Does it work?

This project is a WordPress plugin, While it can be used in conjunction with your site, it may make sense to create a stand alone site as it has a specific purpose.

By default all secrets are secured using WordPress defuse/php-encryption.

• Once a secret is viewed, the secret is deleted from the database.
• Once the secret expires it is deleted from the database.

Dependencies

defuse/php-encryption This is used for encryting post data.

Good to Haves

This plugin works most effectively when using a true crontab and not specifically relying on WordPress built in scheduler This will allow for better accuracy when doing general cleanup.

Crons

By default 3 cron events are scheduled

• 5min : Expire all secrets
• Hourly: Purge and Expired secrets
• Daily: Daily audit to purge any potentially missed secrets

Changelog

Version: 1.0.2

• Cleaned Up Markup
• Fixed an issue where warning would show at incorrect times

Version: 1.0.1

• Fixed an issue with pass phase protected posts not being displayed.

Version: 1.0.0 Initial Release:

psst's Issues

Do not allow link expansion / previews in slack and other chat apps

When you share a link with someone in Slack, the encrypted secret will be displayed to the user.
We need to lock down non browser user agents and bots, additionally, we should block the secret from being displayed at all in the previewing or if some one is using Yoast or another SEO tool.

More than likely the meta data is what is being parsed by Slack and other chat apps

Expiration date should be visible on the secret confirmation page

While the expiration is set, nothing is displayed ot the user. The expiration date should be formatted based on the WordPress site settings

Psst! Needs more branding

Users need more hand holding about how it works

Secret Form template needs more help and tool tips
Frontpage needs more documentation about how we are securing data.

Allow users to register

If you have a secret that has a quote in it, it gets escaped in the output

This causes an issue if someone is sending a secret that specifically needs to be accurate.

" is turned into "

Can't active plugin in Wordpress 5.4.1

Hi Bro,
when it active plugin, it show up error,
Please help me.
Thanks

Allow registered users to send a secret via email through the plugin