🔒 WP Bones 2.1.2 — pages that ask who you are

WP Bones 2.1.2 is out 🦴 a security patch 🔒

🚪 Admin pages check who you are. Pages from config/routes.php and pages/ have no menu entry, so WordPress let any logged-in user open them: the capability key was never read. Now a user without it gets a 403.

🧩 pages/ classes can say it too, with an optional capability() method. The default stays read.

🌐 Public REST routes say so. A route without a permission_callback stays public, and a notice now names it. WP Bones 3.0 will refuse it.

✅ 25 new tests, 200 in all, on PHP 8.1 to 8.4.

⬆️ composer update wpbones/wpbones

👉 Docs, boilerplates and live Playground demos: https://wpbones.com

How do you guard the admin pages in your plugins? I'd love to hear 👀