The Rateo engine, run on ACPT Pro, a custom post type and fields plugin. Every number below comes from the engine's output, which is linked in full at the end.
ACPT Pro is made by the team behind Rateo. We ran it on our own code first.
2026.10.122026.10.7-provisional613dd8ffa9c8f04ca05438a95105c4d021febd707559e14c2d0c73073ae4c1b3build/rateo advanced-custom-post-type --cache=noneplatform PHP: WordPress (plugin header in advanced-custom-post-type.php)
not analysed: 550 files (binary 271, JavaScript 215, CSS 35, Gettext Catalog 16, JSON 4, SVG 3, Markdown 2, INI 1, Ignore List 1, YAML 1, dist 1)
Folders and files not analysed, by reason: Dependency 2.
eval, shell commands, unserialize and includes built from data, SQL with values pasted in, request input never sanitized, output never escapedThe security checks read one call or statement at a time and never follow a value through variables, so they show where to look, not proof of a hole. A long or branchy function is common in a large, mature plugin; each finding is a place worth a closer look, not a judgement of the code as a whole.
| Check | Limits (warning / error) | Warnings | Errors | Total |
|---|---|---|---|---|
| Size | ||||
length.functionA function or method body with too many lines | body lines: above 50 / above 100 | 421 | 201 | 622 |
length.classA class with too many lines | lines: above 500 / above 1000 (other) | 45 | 32 | 77 |
length.fileA file with too many lines | lines: above 600 / above 1200 (other) | 38 | 24 | 62 |
| Complexity | ||||
complexity.functionA function or method with too many paths through it | cyclomatic complexity: above 10 / above 20 | 363 | 195 | 558 |
complexity.file_codeCode outside any function with too many paths through it | cyclomatic complexity: above 10 / above 20 | 1 | 0 | 1 |
| Duplication | ||||
duplication.repeated_blockA block repeated later in the same file, even with its names changed | tokens: 50 or more / never an error | 1,165 | 0 | 1,165 |
| Naming | ||||
naming.inconsistent_styleA name in a different style from most names of its kind in the file | style: differs from the file's main style (groups of 3 or more names) / never an error | 335 | 0 | 335 |
naming.genericA local variable or parameter with a name that says nothing, like $data or $tmp | name: on the list of 16 generic names / never an error | 191 | 0 | 191 |
naming.too_shortA one letter name other than i, j, k, n, x, y, z or e | characters: under 2 / never an error | 136 | 0 | 136 |
naming.too_longA very long name | characters: above 30 / never an error | 154 | 0 | 154 |
A value equal to a limit is no finding.
| File | Findings |
|---|---|
advanced-custom-post-type/src/Integrations/Bricks/providers/provider-acpt.php | 108 |
advanced-custom-post-type/src/Core/API/V1/Controllers/SchemaController.php | 96 |
advanced-custom-post-type/src/Includes/ACPT_Schema.php | 90 |
advanced-custom-post-type/src/Core/Repository/MetaRepository.php | 77 |
advanced-custom-post-type/functions/_inc/values/meta_get.php | 74 |
advanced-custom-post-type/src/Core/CQRS/Query/FetchMetaFieldValueQuery.php | 73 |
advanced-custom-post-type/src/Core/CQRS/Query/FetchFormFieldsQuery.php | 71 |
advanced-custom-post-type/src/Core/Generators/Table/TableRecordPageGenerator.php | 48 |
advanced-custom-post-type/src/Integrations/WPAllImport/Helper/RapidAddon.php | 46 |
advanced-custom-post-type/src/Core/API/AJAX/Controllers/MetaController.php | 44 |
| Folder | Findings |
|---|---|
src/ | 3,280 |
functions/ | 148 |
migrations/ | 41 |
admin/ | 6 |
init/ | 5 |
BOverall: 82 out of 100
3 of 5 metrics graded
round((3 × 87Complexity+2 × 66Duplication+1 × 96Naming) ÷ 6) = 82
Weights: Complexity 3, Duplication 2, Naming 1. Size and Security are not graded, so they are left out and the other weights are rescaled.
A summary of the grades below, which you can recompute. Not a pass mark, and not a hiring decision.
The table shows how many files got each letter. A file with nothing to judge for a metric gets no grade for it. The whole plugin column pools every file's grade, so a file with more code to judge counts for more. The overall above weights those whole plugin grades. In the full engine output these are CodeLength, CyclomaticComplexity, Duplication, NamingConvention and Security.
| Metric | A | B | C | D | F | Not graded | Whole plugin |
|---|---|---|---|---|---|---|---|
| Size | Findings only, no grade | ||||||
| Complexity | 767 | 68 | 78 | 14 | 82 | 53 | 87 B |
| Duplication | 860 | 25 | 60 | 0 | 115 | 2 | 66 D |
| Naming | 962 | 70 | 22 | 1 | 4 | 3 | 96 A |
| Security | Findings only, no grade | ||||||
Findings only, never a grade: a wrong security grade would hurt more than none. A finding the author already silenced with a phpcs comment counts as suppressed, apart from Errors and Warnings, so you can tell reviewed code from unreviewed code.
| Check | Errors | Warnings | Suppressed |
|---|---|---|---|
security.evalA call to eval, which runs a string as PHP code | 0 | 0 | 0 |
security.shellA shell command built from data | 0 | 0 | 0 |
security.unserializeunserialize without allowed_classes => false | 0 | 0 | 0 |
security.include_variableAn include or require whose path is built from a variable | 0 | 5 | 0 |
security.extract_inputextract of request input, which turns its fields into variables | 0 | 0 | 0 |
security.sql_interpolatedSQL with a value pasted in instead of passed through prepare | 0 | 10 | 8 |
security.unescaped_outputAn echo, print or <?= of a value that is not escaped | 0 | 117 | 0 |
security.unsanitized_inputA request input read with no sanitizer around it | 0 | 47 | 0 |
Up to 10 places, Errors first, then Warnings, then by path and line. An Error means request input reaches the call or the output directly.
advanced-custom-post-type/admin/templates/app.php:31echo of `strtoupper(ACPT_SKIN)` is not escaped at output; escape where you print (esc_html, esc_attr, htmlspecialchars)
| 31 | <!-- ACPT <?php echo strtoupper(ACPT_SKIN); ?> SKIN --> |
| 32 | <style> |
| 33 | #wpfooter, #wpcontent { |
| 34 | background: <?php echo $footerBg; ?>; |
| 35 | color: <?php echo $footerColor; ?>; |
| 36 | } |
| 37 | |
| 38 | #wpfooter a { |
| 39 | color: <?php echo $footerLinkColor; ?>; |
| 40 | } |
advanced-custom-post-type/admin/templates/app.php:34echo of `$footerBg` is not escaped at output; escape where you print (esc_html, esc_attr, htmlspecialchars)
| 34 | background: <?php echo $footerBg; ?>; |
| 35 | color: <?php echo $footerColor; ?>; |
| 36 | } |
| 37 | |
| 38 | #wpfooter a { |
| 39 | color: <?php echo $footerLinkColor; ?>; |
| 40 | } |
| 41 | |
| 42 | #wpfooter a:hover, |
| 43 | #wpfooter a:focus { |
advanced-custom-post-type/admin/templates/app.php:35echo of `$footerColor` is not escaped at output; escape where you print (esc_html, esc_attr, htmlspecialchars)
| 35 | color: <?php echo $footerColor; ?>; |
| 36 | } |
| 37 | |
| 38 | #wpfooter a { |
| 39 | color: <?php echo $footerLinkColor; ?>; |
| 40 | } |
| 41 | |
| 42 | #wpfooter a:hover, |
| 43 | #wpfooter a:focus { |
| 44 | color: <?php echo $footerLinkHoverColor; ?>; |
advanced-custom-post-type/admin/templates/app.php:39echo of `$footerLinkColor` is not escaped at output; escape where you print (esc_html, esc_attr, htmlspecialchars)
| 39 | color: <?php echo $footerLinkColor; ?>; |
| 40 | } |
| 41 | |
| 42 | #wpfooter a:hover, |
| 43 | #wpfooter a:focus { |
| 44 | color: <?php echo $footerLinkHoverColor; ?>; |
| 45 | } |
| 46 | |
| 47 | ul#adminmenu a.wp-has-current-submenu:after { |
| 48 | border-right-color: <?php echo $footerBg; ?>; |
advanced-custom-post-type/admin/templates/app.php:44echo of `$footerLinkHoverColor` is not escaped at output; escape where you print (esc_html, esc_attr, htmlspecialchars)
| 44 | color: <?php echo $footerLinkHoverColor; ?>; |
| 45 | } |
| 46 | |
| 47 | ul#adminmenu a.wp-has-current-submenu:after { |
| 48 | border-right-color: <?php echo $footerBg; ?>; |
| 49 | } |
| 50 | </style> |
| 51 | <?php endif; ?> |
advanced-custom-post-type/admin/templates/app.php:48echo of `$footerBg` is not escaped at output; escape where you print (esc_html, esc_attr, htmlspecialchars)
| 48 | border-right-color: <?php echo $footerBg; ?>; |
| 49 | } |
| 50 | </style> |
| 51 | <?php endif; ?> |
advanced-custom-post-type/migrations/202604010001_migrate_location_data_to_junction.php:76query `$wpdb->get_results` builds its SQL from `$prefixedName`; pass values through prepare with placeholders to prevent SQL injection
| 76 | $columns = $wpdb->get_results("SHOW COLUMNS FROM `{$prefixedName}` LIKE 'location_rule'"); |
| 77 | |
| 78 | if (empty($columns)) { |
| 79 | continue; |
| 80 | } |
| 81 | |
| 82 | // Copy existing data to junction table |
| 83 | ACPT_DB::executeQueryOrThrowException( |
| 84 | "INSERT IGNORE INTO `{$junctionTable}` (table_name, record_id, location_rule, location_value) |
| 85 | SELECT %s, id, location_rule, location_value |
advanced-custom-post-type/migrations/202604010001_migrate_location_data_to_junction.php:92query `$wpdb->query` builds its SQL from `$prefixedName`; pass values through prepare with placeholders to prevent SQL injection
| 92 | $wpdb->query("ALTER TABLE `{$prefixedName}` DROP INDEX `idx_location`"); |
| 93 | $wpdb->query("ALTER TABLE `{$prefixedName}` DROP COLUMN `location_rule`, DROP COLUMN `location_value`"); |
| 94 | } |
| 95 | } |
| 96 | } |
advanced-custom-post-type/migrations/202604010001_migrate_location_data_to_junction.php:93query `$wpdb->query` builds its SQL from `$prefixedName`; pass values through prepare with placeholders to prevent SQL injection
| 93 | $wpdb->query("ALTER TABLE `{$prefixedName}` DROP COLUMN `location_rule`, DROP COLUMN `location_value`"); |
| 94 | } |
| 95 | } |
| 96 | } |
advanced-custom-post-type/src/Admin/ACPT_Admin.php:379require_once of `$template` builds the file path from data; a crafted path can load another file
| 379 | require_once plugin_dir_path(dirname(__FILE__)) . '../admin/templates/'.$template.'.php'; |
| 380 | }, |
| 381 | $position |
| 382 | ); |
| 383 | } else { |
| 384 | add_menu_page( |
| 385 | $pageTitle, |
| 386 | $menuTitle, |
| 387 | $capability, |
| 388 | $menuSlug, |
Security findings are listed in their own section above. A place is a file and a line, so a function that is both too long and too complex shows once, with both findings. Places rank by their worst finding: errors first, then by how far the measured value goes beyond its limit. Each message is the engine's own, word for word.
2 places are left out of this list because the engine flags them by mistake: advanced-custom-post-type/src/Includes/ACPT_Schema.php:19, the plugin's database tables written as one array of data, not logic; advanced-custom-post-type/src/Core/API/V1/Controllers/SchemaController.php:189, the plugin's API description written as one array of data, not logic. Their findings still count in the grades, the tables above and the full output.
advanced-custom-post-type/src/Integrations/Bricks/providers/provider-acpt.php:699Provider_ACPT::get_tag_value has a cyclomatic complexity of 298, untestable risk (above 10): each of its 298 paths needs its own test, which makes it hard to follow and to change safely
Provider_ACPT::get_tag_value has 1104 lines in its body, above 100
| 699 | public function get_tag_value($tag, $post, $args, $context) |
| 700 | { |
| 701 | try { |
| 702 | // A Toggle without a value must not reuse the previous loop item's (#1419) |
| 703 | unset(self::$condition_toggle_values[$tag]); |
| 704 | |
| 705 | if (!isset($this->tags[$tag])) { |
| 706 | return null; |
| 707 | } |
| 708 |
advanced-custom-post-type/src/Integrations/Gutenberg/Generators/ACPTBlocks/Blocks/RepeaterLoopBlockRenderer.php:282RepeaterLoopBlockRenderer::realValue has a cyclomatic complexity of 264, untestable risk (above 10): each of its 264 paths needs its own test, which makes it hard to follow and to change safely
RepeaterLoopBlockRenderer::realValue has 751 lines in its body, above 100
| 282 | private function realValue(string $fieldType, $rawValue, array $parsed = [], $before = null, $after = null) |
| 283 | { |
| 284 | $raw = $parsed['raw'] ?? false; |
| 285 | $subKey = $parsed['subKey'] ?? null; |
| 286 | $args = $parsed['args'] ?? []; |
| 287 | |
| 288 | // Legacy: if $parsed is a plain array of args (old callers), keep working |
| 289 | if (isset($parsed[0])) { |
| 290 | $args = $parsed; |
| 291 | $raw = false; |
advanced-custom-post-type/src/Integrations/Gutenberg/Generators/ACPTBlocks/Blocks/BasicBlockRenderer.php:65BasicBlockRenderer::getRawData has a cyclomatic complexity of 260, untestable risk (above 10): each of its 260 paths needs its own test, which makes it hard to follow and to change safely
BasicBlockRenderer::getRawData has 877 lines in its body, above 100
| 65 | private function getRawData(array $field, array $attributes = []) |
| 66 | { |
| 67 | $findValue = null; |
| 68 | |
| 69 | // try to calculate $find and $findValue |
| 70 | if (isset($field['belongsTo']) && $field['belongsTo'] === MetaTypes::OPTION_PAGE) { |
| 71 | $findValue = $field['find']; |
| 72 | $find = 'option_page'; |
| 73 | } elseif (isset($field['belongsTo']) && $field['belongsTo'] === MetaTypes::TAXONOMY) { |
| 74 | $find = 'term_id'; |
advanced-custom-post-type/src/Core/CQRS/Command/SaveMetaFieldValueCommand.php:73SaveMetaFieldValueCommand::execute has a cyclomatic complexity of 210, untestable risk (above 10): each of its 210 paths needs its own test, which makes it hard to follow and to change safely
SaveMetaFieldValueCommand::execute has 977 lines in its body, above 100
| 73 | public function execute(): bool |
| 74 | { |
| 75 | $metaFieldModelType = $this->fieldModel->getType(); |
| 76 | $savedFieldValue = $this->get($this->fieldModel->getDbName()); |
| 77 | $savedFieldType = $this->get($this->fieldModel->getDbName().'_type'); |
| 78 | $savedFieldId = $this->get($this->fieldModel->getDbName().'_id'); |
| 79 | $value = self::objectsToIds($this->args['value'] ?? null); |
| 80 | |
| 81 | // check is value is changed, if not, do nothing and return true |
| 82 | if ($savedFieldValue == $value) { |
advanced-custom-post-type/src/Integrations/Divi/includes/ACPT_Divi_Dynamic_Content_Tags.php:284ACPT_Divi_Dynamic_Content_Tags::renderField has a cyclomatic complexity of 178, untestable risk (above 10): each of its 178 paths needs its own test, which makes it hard to follow and to change safely
ACPT_Divi_Dynamic_Content_Tags::renderField has 626 lines in its body, above 100
method `renderField` is camelCase, while most methods in this file are snake_case (5 of 9 names); mixed styles make code harder to scan
| 284 | private function renderField( |
| 285 | string $fieldType, |
| 286 | $val, |
| 287 | ?string $pfx, |
| 288 | ?string $sfx, |
| 289 | string $display_as, |
| 290 | string $list_style, |
| 291 | string $enable_html, |
| 292 | ?string $date_format, |
| 293 | ?string $custom_date_format, |
advanced-custom-post-type/src/Core/Generators/Table/TableRecordPageGenerator.php:1174TableRecordPageGenerator::locationRuleOptions has a cyclomatic complexity of 152, untestable risk (above 10): each of its 152 paths needs its own test, which makes it hard to follow and to change safely
TableRecordPageGenerator::locationRuleOptions has 446 lines in its body, above 100
| 1174 | protected function locationRuleOptions(array $location = [], string $ruleKey = ''): string |
| 1175 | { |
| 1176 | $selectedKey = $ruleKey; |
| 1177 | |
| 1178 | $postTypes = []; |
| 1179 | $taxonomies = []; |
| 1180 | $optionPages = []; |
| 1181 | $mediaFormats = []; |
| 1182 | $userIds = []; |
| 1183 | $valueless = []; |
advanced-custom-post-type/src/Core/CQRS/Query/FetchMetaFieldValueQuery.php:30FetchMetaFieldValueQuery::execute has a cyclomatic complexity of 141, untestable risk (above 10): each of its 141 paths needs its own test, which makes it hard to follow and to change safely
FetchMetaFieldValueQuery::execute has 699 lines in its body, above 100
| 30 | public function execute() |
| 31 | { |
| 32 | // Prevent any error if one of those functions is undefined: |
| 33 | if (!function_exists('get_user_by')) { |
| 34 | include_once(ABSPATH . 'wp-includes/pluggable.php'); |
| 35 | } |
| 36 | |
| 37 | if (!function_exists('get_term')) { |
| 38 | include_once(ABSPATH . 'wp-includes/taxonomy.php'); |
| 39 | } |
advanced-custom-post-type/src/Utils/Checker/FieldVisibilityChecker.php:99FieldVisibilityChecker::returnTrueOrFalseForALogicBlock has a cyclomatic complexity of 137, untestable risk (above 10): each of its 137 paths needs its own test, which makes it hard to follow and to change safely
FieldVisibilityChecker::returnTrueOrFalseForALogicBlock has 477 lines in its body, above 100
method `returnTrueOrFalseForALogicBlock` is 31 characters (limit 30); very long names make code hard to read
| 99 | private static function returnTrueOrFalseForALogicBlock( |
| 100 | $elementId, |
| 101 | string $belongsTo, |
| 102 | MetaFieldModel $metaBoxFieldModel, |
| 103 | array $conditions, |
| 104 | array $liveData = [], |
| 105 | ?int $fieldIndex = null, |
| 106 | ?string $blockName = null, |
| 107 | ?int $blockIndex = null |
| 108 | ): bool { |
advanced-custom-post-type/src/Core/Generators/CustomPostType/CustomPostTypeAdminColumnsGenerator.php:37CustomPostTypeAdminColumnsGenerator::addColumns has a cyclomatic complexity of 131, untestable risk (above 10): each of its 131 paths needs its own test, which makes it hard to follow and to change safely
CustomPostTypeAdminColumnsGenerator::addColumns has 523 lines in its body, above 100
| 37 | public static function addColumns($postTypeModel): void |
| 38 | { |
| 39 | $postTypeName = ($postTypeModel instanceof CustomPostTypeModel) ? $postTypeModel->getName() : $postTypeModel; |
| 40 | |
| 41 | $manageEditAction = 'manage_edit-'.$postTypeName.'_columns'; |
| 42 | $manageEditSortAction = 'manage_edit-'.$postTypeName.'_sortable_columns'; |
| 43 | $customColumnsAction = 'manage_'.$postTypeName.'_posts_custom_column'; |
| 44 | $bulkActionsAction = 'bulk_actions-edit-'.$postTypeName; |
| 45 | |
| 46 | // Specific fix for Media attachments |
advanced-custom-post-type/src/Core/Helper/CCTFieldShape.php:263CCTFieldShape::coerce has a cyclomatic complexity of 130, untestable risk (above 10): each of its 130 paths needs its own test, which makes it hard to follow and to change safely
CCTFieldShape::coerce has 281 lines in its body, above 100
| 263 | public static function coerce($oldValue, string $targetUiType) |
| 264 | { |
| 265 | if ($oldValue === null || $oldValue === '') { |
| 266 | return null; |
| 267 | } |
| 268 | |
| 269 | // Decode JSON strings |
| 270 | if (is_string($oldValue) && self::looksLikeJson($oldValue)) { |
| 271 | $oldValue = json_decode($oldValue, true); |
| 272 | } |
All 3,480 findings, plus 8 suppressed by a phpcs comment, exactly as the engine printed them: wordpress-acpt.txt (plain text).