Hi @marklcm
I’ve looked at the plugin and ran a test.
The results are not accurate due to the way it processes the files in the plugin.
I use the wordpress guidelines of building the plugins.
$text = esc_html( '<p>This is some text</p>' );
echo $text;
The above code is perfectly valid and safe, but the plugin will flag it as Error because the text is not escaped but in fact is escaped.
$url = "https://example.com?q=search";
$url_esc = esc_url( $url);
echo $url;
For the above will complain the url is not escaped, but it is.
Hope you get my point.
The plugin uses nonce for all ajax requests.
Doing my best to keep it at wordpress coding standards.
Let me know if you have any other questions.
Regards,
Dan.