WordPress 7 Abilities API Security: Patterns Every Tutorial Skips
Every WordPress 7 Abilities API tutorial ships the five-line `__return_true` pattern. It works on a laptop. It's also the shortest path to an AI-callable backdoor on production. Here's the hardened permission + input + output schema stack production sites need, plus a 12-point pre-ship audit.