Add plugin audit report (security, performance, best practices, accessibility)

[unscripted]

Changes proposed in this pull request

This PR adds a full audit report of the Matchbox Support plugin (docs/plugin-audit-2026-07.md) covering security, performance, best practices, technical debt, and accessibility, with severity ratings and a prioritized remediation order. No plugin code is changed — the report is documentation only.

Highest-priority findings summarized in the report:

• The Userback access token is echoed into inline JavaScript without escaping (stored XSS vector).
• The Userback/HelpScout save-time validators are broken (json_decode null check is dead code), so invalid values are marked valid, and saved values can never be cleared from the UI.
• The login-security username blocklist can lock out a legitimate existing admin account.
• Userback toggle assets (plus a jQuery dependency) load for all visitors even when the widget never renders.
• Admin-bar toggles are not keyboard or screen-reader accessible.
• 69 open Dependabot alerts on the default branch (npm dev-dependency tree).

Closes: N/A — audit requested directly in a Claude session; no Asana task or GitHub issue exists yet.

Pre-submit checklist

As the author of this pull request, I verify that:

• I have set the target branch to main.
• I have detailed the purpose of this Pull Request in a non-technical way.
• I have detailed how to test the changes in the Pull Request.
• I have detailed the functional tests required for approval.
• I have performed a self-review of my code to ensure it is DRY and follows the team's coding standards.
• I have commented my code, particularly in hard-to-understand areas.
• I have made corresponding changes to the documentation.
• I have verified that my code does not introduce a debug warning in my local environment.
• I have verified that the functional tests work in my local environment.
• I have verified that all automated tests pass or have provided a detailed comment about why I am submitting with a failed pipeline. (Leave unchecked if the repository does not include automated tests.)
• I have verified that any dependent changes have been merged and published in downstream commits.
• I have added a link to this Pull Request in the Asana task.
• I have moved the Asana task to "Ready for Functional Review".
• I have left a comment in Asana and GitHub tagging a team member with a request for review.

Testing

How to test the changes in this pull request

Follow the steps below to test the changes in this PR.

1. Open docs/plugin-audit-2026-07.md in this branch (no deploy needed — documentation only).
2. Spot-check the cited code references against the source files (e.g. src/MatchboxSupport/Userback.php:84-95, src/MatchboxSupport/Plugin.php:1012-1027).
3. Review the priority order in section 5 and confirm it matches the team's appetite for follow-up work.

Functional tests

As the functional tester for this pull request, I verify that:

• It adds only a documentation file and changes no plugin code.
• It does not affect plugin behavior, the release ZIP, or the build pipeline.
• The file/line references in the report point at the code they describe.
• The findings and severity ratings read as accurate to someone familiar with the plugin.

Once testing is complete, notify the author of any failed tests and move the task to "Kick back" in Asana. If all tests pass, move the task to "Ready for Code Review" in Asana and tag a team member for code review.

Code review

As the code reviewer for this pull request, I verify that:

• All automated tests have passed.
• The code is written (or documented) in a way that is easy to understand.
• The code is free of obvious errors and duplication.
• The code follows our coding standards.
• The code is sanitized or escaped appropriately for any SQL or XSS injection possibilities.

Once testing is complete, notify the author of any failed tests and move the task to "Kick back" in Asana or continue with the "merging" steps below.

Merging

As the individual merging this pull request, I verify that:

• All automated tests have passed.
• All functional tests have passed.
• All code review tests have passed.
• I have moved the task to "Ready to Deploy" in Asana and notified the pull request author.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MN92G1Ef9aMEVmDm8fV7gA

---

Generated by Claude Code