Security

• BB Media writes only its own tables and, when switched on, WebP/AVIF copies next to uploads files (name.ext.webp, name.ext.avif). It changes no attachment data and deletes no media. Each copy it writes is recorded (bytes and modification time) and it only overwrites or deletes a copy that is recorded and unchanged: a file someone uploaded under the same name, which WordPress allows, is never touched or served as a copy.
• The usage scan unserializes stored values once, without objects, and walks them with a budget; the unused reports refuse until a full scan has finished.
• "Used in" lists only posts the viewer can read; options, terms and theme files only for administrators.
• BB Migrate's same-content reuse only picks attachments an administrator owns.
• The Media index screen, its buttons and the CSV export need manage_options and a nonce. "Used in" is shown to users who can upload files. There is no public endpoint; bb_media_lookup() is a PHP function for other plugins.
• Paths are resolved inside uploads only; .. is refused.
• The CSV writes cells that a spreadsheet would treat as a formula as text.
• Images are processed with the server's ImageMagick, as WordPress itself does for uploads, only in background batches, never during a page request. Direct reads name the decoder from the file extension; images over 50 megapixels are not copied.

Reporting: see SECURITY.md.