STICKY-ADMIN 1.0.7 - SECURITY REVIEW
Date: 7 October 2026

RESULT
No obvious security vulnerabilities found in the plugin source reviewed.
This is a source review and targeted test run, not a penetration test of the
hosting environment, Joomla installation or other extensions.

PREVIOUS PHP CHECKS (1.0.3) AND RETAINED SOURCE REVIEW
1. Native PHP 8.3.6 lint: services/provider.php,
   src/Extension/Stickyadminmenu.php and script.php.
2. Direct execution without _JEXEC exits before running extension logic.
3. Seven PHP scope cases with Joomla API stubs: frontend, guest, missing
   identity, other template, component popup, non-HTML document and
   authenticated Atum administrator. Only the last case registers assets.
4. Four PHP settings cases: negatives, excessive values, hostile strings
   and valid values. Output options are bounded integers.
5. Service provider boot and asset dependency checks with Joomla API stubs.
6. Installer contract tests with JVERSION 5.4.9 and 6.0.0 (API stubs):
   fresh-install activation, preservation of existing disabled and enabled
   states, discover-install, scoped database update, matching completion
   messages, database read-failure fallback and uninstall exclusion.
7. JavaScript syntax and DOM-stub checks: bounded settings, hostile strings,
   mobile exclusion, header height and operation without a sidebar.
8. Manifest XML, declared files, languages and assets validated; archive
   integrity and safe relative ZIP paths checked.
9. Manual source review: no uploads, shell execution, deserialisation,
   credential storage, remote requests or dynamic includes. Tooltips use
   textContent/setAttribute, not HTML insertion. CSS values are numeric.
10. Installer database mutation is limited by fixed, quoted predicates:
    type=plugin, folder=system and element=stickyadminmenu. It writes only
    enabled=1 for confirmed first installation. Updates do not write this
    flag. Failure to read the previous state prevents automatic activation;
    failure to confirm activation displays a manual-enable warning without
    exposing database exception details.
11. No new public HTTP endpoint or custom state-changing form. Installation
    and settings use Joomla's protected administrator flows.

HARDENING RETAINED
Missing-identity guard, integer setting filters, server-side bounds,
explicit versioned assets, administrator/HTML/Atum restrictions and _JEXEC
entry guards. No Joomla core files, content or other extension rows changed.

LIMITATIONS
PHP lint ran on 8.3.6. Contract tests use stubs, not full Joomla installations,
and do not replace PHPStan with Joomla dependencies or live testing.
Automated browser layout tests remain unavailable because Chromium is not
installed. The user reported live success with original menu functionality;
this tabs update has not been live-tested in this environment.

1.0.5 REVIEW
Article tab changes use scoped DOM selection, numeric CSS properties and CSS
positioning. No HTML insertion, new endpoints, permission changes, remote
requests or database changes. Only PHP asset version strings changed.
JavaScript syntax and DOM-stub checks passed for toolbar offsets, missing
toolbar, article scope, accordion and responsive cleanup. XML and ZIP checks
passed. PHP is unavailable in this run; earlier PHP checks were not re-run.
Live tab layout and keyboard interaction still require Joomla verification.

1.0.5 REVIEW
Extended the existing primary-tab selectors to #module-form. No new PHP
logic or security-sensitive operation. JavaScript and package checks re-run.
Module tab positioning requires live Joomla verification.

1.0.6 REVIEW
Added a fixed HTTPS update-server URL in the manifest. The external update
XML uses client=site, folder=system, element=stickyadminmenu and Joomla 5/6
platform constraints. SHA-256 matches the exact installer ZIP. XML and archive
checks passed. Existing JavaScript checks passed. PHP runtime unavailable;
only PHP asset version strings changed. Remote feed retrieval and native
Joomla update installation require testing once the files are uploaded.

1.0.7 REVIEW
Added user-approved public author contact metadata. No runtime logic changed.
Manifest fields, feed version, exact SHA-256 and both archives checked.
