Security Architecture & Cryptographic Standards
Technical Specification • Published: October 2026
Defense-in-Depth Architecture:
Digent Smart AI connects your AI workflows to WordPress without opening arbitrary ports, without storing administrative passwords in the cloud, and without exposing direct database socket connections.
Cryptographic Request Signing (HMAC-SHA256)
Every request forwarded from our Cloud Gateway to your WordPress site is cryptographically signed using an HMAC-SHA256 digest calculated over the request body, timestamp, and a random cryptographic nonce.
The WordPress plugin verifies this signature before parsing or executing any instruction. Because the signature depends on the exact request payload and timestamp, man-in-the-middle tampering immediately invalidates the cryptographic check.
Anti-Replay Protection & Timestamp Drift
To prevent attackers from capturing and replaying previous tool calls, each signed request includes an absolute UNIX timestamp:
- If the timestamp deviates by more than 300 seconds (5 minutes) from the WordPress server clock, the request is immediately rejected.
- Nonces are tracked in WordPress transient memory to prevent duplicated payloads from executing twice.
AES-256 Encryption at Rest
All shared secret keys (sec_*) generated during the 1-Click Connect flow are encrypted using industry-standard AES-256-CBC before persistence. No cleartext secrets exist in database tables or unencrypted backups.
Filesystem Sandboxing & Traversal Guard
AI file tools (read_file, write_file, list_directory) are strictly confined to the WordPress wp-content hierarchy:
wp-config.php, parent directories (../), or server roots (/etc/passwd, C:\Windows) are halted immediately by realpath canonicalization guardrails.
WP-CLI Command Whitelist Guardrails
Arbitrary bash execution, raw shell injection, and chained commands (e.g. ; rm -rf /, | curl ...) are intercepted and rejected. Only whitelisted WP-CLI subcommands (plugin, theme, cache, transient, menu, rewrite) are routed to WordPress.