Nonce verification recommended

Why It Shows Up

The scan saw request handling that may not always mutate state, but still looks like a user-triggered action that should usually be protected by a nonce.

Why It Matters

Adding a nonce reduces accidental or forged requests and documents that the action is expected to originate from the plugin UI.

How to Fix

• For admin forms and action links, add and verify a nonce.
• For AJAX handlers, use `check_ajax_referer()`.
• For public read-only endpoints, document why a nonce is not required and keep input validation strict.

References