=== Kwistech Secure — Insurance Evidence Pack ===
Contributors: kwistech
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Requires Plugins: kwistech-secure
Stable tag: 1.1.2
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Generates a dated Insurance / broker evidence pack describing this site's security posture. Requires Kwistech Secure and a per-site licence key.

== Description ==

**This plugin is not distributed through the WordPress.org plugin directory and never will
be.** It is sold from https://kwistech.ca/kwistech-secure and installed by uploading a zip.
Directory Guideline 5 forbids functionality locked behind payment, and this plugin is exactly
that, so listing it there is not an option. The free half -- Kwistech Secure -- is in the
directory, contains no locked functionality, and is fully useful on its own.

This readme exists anyway, for two reasons. WordPress reads the header block when it displays
the plugin, and running the same Plugin Check over both halves is cheaper than remembering
which rules apply to which one.

The add-on takes what the free plugin already records -- hardening control states, the audit
log, sign-in history, application password inventory -- and renders it as two artefacts dated
at the moment you generate them:

* a **PDF** written for a human: a broker, an underwriter, or whoever asked you the question.
* a **JSON** file with the same content, for anyone who wants to parse it.

Both are generated on your own server. The licence is verified offline against an Ed25519
public key compiled into the plugin, so no request leaves your site at any point -- not to
check the licence, not to generate a pack, not ever.

== Frequently Asked Questions ==

= Does it make my site secure? =

No. The free plugin applies the controls; this one describes what they are currently doing.
A pack is a statement of posture on a date, not a certification and not insurance. It says so
on its own first page.

= What happens when the licence expires? =

Packs already generated stay where they are and stay valid -- they are dated documents about
a date that has passed. You cannot generate new ones until the licence is renewed.

= Where are the packs stored? =

`wp-content/uploads/kwistech-secure/`, protected by a generated .htaccess, and never given a
public URL. They are deleted automatically once the retention period you configure has
elapsed, because they contain staff names and email addresses.

== Changelog ==

= 1.1.2 =
* Turns off the free plugin's add-on notice as soon as this plugin boots, via the new
  `kwistech_secure_show_addon_notice` filter. Previously the free plugin recognised this one
  by folder name, which fails for anyone who installs by unzipping a versioned archive by
  hand -- and being advertised a product you have already paid for is a poor first impression.
* The readme title now matches the plugin header exactly. They differed by one character, a
  hyphen against an em dash, which Plugin Check reports at severity 7.

= 1.1.1 =
* Table names in the pack-record queries now use the `%i` identifier placeholder rather than
  being interpolated into the SQL string, matching the free plugin.
* The evidence exceptions submitted from the settings screen are sanitised leaf by leaf, with
  a bounded recursion depth. They were unslashed but not sanitised, and they end up in a PDF
  a broker reads.
* Global function and variable names in uninstall.php now carry the plugin prefix.
* Added this readme.

= 1.1.0 =
* Renamed to match the free plugin's new slug: the folder is now `kwistech-secure-evidence`
  and `Requires Plugins` points at `kwistech-secure`.
* **Fixed a text domain bug that would have broken every future translation.** 325 of this
  plugin's 359 translatable strings were tagged with the *free* plugin's text domain, left
  over from the 1.2.0 split. They would have stayed in English permanently.
* Pack directories from before the rename are migrated rather than abandoned. Packs are moved,
  never overwritten and never deleted, so that they stay inside the retention sweep -- an
  orphaned directory of personal data with no expiry is worse than an ugly folder name.
* Requires the free plugin at 1.3.0 or newer. Against 1.2.0 the hook names differ and this
  plugin's screens simply never appear, with no error, which is the failure that check exists
  to convert into a sentence.

= 1.0.0 =
* First release as a separate plugin, split out of Kwistech Secure 1.1.0. See
  docs/ADR-0005-plugin-split.md.
