essential-addons-for-elementor-lite

Audit and fix WordPress / WooCommerce plugins that leak password-protected post content through AJAX handlers or listing-widget queries. Catches the specific gap that `is_visible()` + `post_status === 'publish'` checks miss: password-protected posts keep `post_status='publish'`, so they bypass draft/private guards while their full content (title, price, SKU, description, permalink) is rendered to unauthenticated visitors. Use when a report mentions "password-protected product/post leak", "quickview exposure", "post_password not enforced", or whenever reviewing a `wp_ajax_nopriv_` endpoint that loads a single post's content, or any widget that builds a new `WP_Query` for a public listing.

Audit and fix WordPress AJAX handlers registered via wp_ajax_nopriv_* that build WP_Query args from client input. Catches the common pattern where a handler overrides post_status/post_type to 'any' (or trusts client-supplied post__in / author / meta_query) and ends up exposing private, draft, pending, future, trash, or auto-draft content to unauthenticated visitors. Use when reviewing or hardening any wp_ajax_nopriv_ endpoint, or when a report mentions "unauthenticated information disclosure" / "draft exposure" / "private post leak" in a WordPress plugin.

Ship a change via a feature branch and pull request — never directly to the default branch. Use after any code change, fix, refactor, or docs update that needs to land on main. Branches are named `<card-number>` from the FluentBoards card. Commits go through the husky pre-commit hook (lint-staged); pushes go to the feature branch only; the PR body links back to the card. Hard refuses any push to main / master / trunk.

Pre-flight checklist for shipping an EA Lite release to WordPress.org. Use when bumping a version, preparing a release branch, building a distribution zip, or before tagging. Walks through quality gates, version bump in three required files, changelog format, .distignore audit, and post-release verification. No phase is skippable — wordpress.org publishes whatever the Stable tag points to.

Scaffold a new Essential Addons widget end-to-end — gather requirements, generate PHP class, SCSS, optional JS, register in config.php, optional Pro upsell, build, and verify. Use when adding any new widget, even simple display ones. Outputs files that already follow EA conventions (text domain, BEM, Asset_Builder deps, render method) so the next session can start with controls + render logic, not boilerplate.

Design and audit Elementor controls for an EA widget. Use when adding controls to a new or existing widget, refactoring a messy `register_controls()`, deciding between control types, or wiring conditions, responsive, and selectors. Outputs control code that follows EA conventions and renders sensibly with default values.

Systematic root-cause debugging for an EA widget. Use when a widget is reported broken, a fix didn't take effect, editor and frontend diverge, or asset/AJAX failures are suspected. Reproduce → localize → trace → fix-at-root → guard. Every step ends with a confirming signal — no guesses.

Senior-level audit of a single EA widget across five axes — correctness, security, i18n, asset hygiene, and architecture. Use when asked to "review", "audit", or "check" a widget in `includes/Elements/`, before merging widget changes, or after porting a widget between Lite and Pro. Produces a structured report with file:line references and concrete fix suggestions.