diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4cf1e44..dcc69e8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,6 +28,23 @@ jobs:
       - name: Lint every PHP file
         run: find . -name '*.php' -not -path './.git/*' -print0 | xargs -0 -n1 -P4 php -l
 
+  phpcs:
+    name: WordPress coding standards
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+          coverage: none
+          tools: composer:v2
+      - run: composer install --no-interaction --no-progress
+      # phpcs.xml.dist: WordPress-Extra + PHPCompatibilityWP (7.4-) on the files the archive ships. Every
+      # phpcs:ignore in the code carries its reason on the same line; the gate honours them, and the second run
+      # lists what they cover so a review can read it in the log without trusting the annotations.
+      - run: composer lint
+      - run: composer lint:all -- --report=source || true
+
   metadata:
     name: Plugin metadata is consistent
     runs-on: ubuntu-latest
diff --git a/README.md b/README.md
index 8d0e59f..cea887f 100644
--- a/README.md
+++ b/README.md
@@ -135,10 +135,15 @@ SHA-256 is stored.
   GET. The first accepted call of any route pairs the key with it — an access
   check that reads a non-existent export (`404 bridge_not_found`) included;
   another pairing is refused.
-- It acts as the administrator who created it, while they still have `export`
-  + `manage_options`, and opens these routes only. It sees only the exports it
-  started, and runs one at a time: another scope while one runs is
-  `409 bridge_export_live`; once that one is `ready` or `failed`, a rerun starts.
+- It runs with **no WordPress user** (`get_current_user_id()` is 0 for the whole
+  request) and opens these routes only; it is valid while the administrator who
+  created it still has `export` + `manage_options` (checked with `user_can()` on
+  their id, never by signing them in). It sees only the exports it started —
+  indexed in the plugin's own option, never in a user's meta — and runs one at a
+  time: another scope while one runs is `409 bridge_export_live`; once that one
+  is `ready` or `failed`, a rerun starts. An export the administrator started
+  with an application password is never reused, bound or replaced by the key.
+  Revoking the key removes its exports.
 - Unpaired, it stops working an hour after it was created. Paired, it has no
   idle limit (reruns can be days apart) and works until 14 days after it was
   created, or until it is revoked (the Bridge screen, or `DELETE /key`) or
diff --git a/RELEASING.md b/RELEASING.md
index 92e21e1..51229a1 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -15,6 +15,7 @@ listed at the end, and they are not paperwork.
 
 ```bash
 npm ci --ignore-scripts
+composer install && composer lint   # PHP_CodeSniffer: WordPress-Extra + PHPCompatibilityWP (phpcs.xml.dist)
 npm run test:wordpress    # container acceptance suite
 npm run test:plugin       # official Plugin Check
 npm run test:store        # contentrain validate + canonical byte parity
@@ -35,10 +36,11 @@ nothing to check. Start from `docker compose -f tests/compose.yml down -v` — a
 reused stack keeps the content of previous runs, which inflates the check and
 entry counts and makes a local number look unlike CI's.
 
-Last full clean run (0.7.0): 394 acceptance checks · Plugin Check 0 errors / 4
-warnings (the four WPML hook names, below) · `contentrain validate` 14 models,
-62 entries · canonical byte parity 55 files · 5 documents carry frontmatter ·
-handoff, reader and uninstall pass · archive 33 runtime files.
+Last full clean run (0.7.1): 399 acceptance checks · Plugin Check 0 errors / 0
+warnings (the four WPML hook names, below, now carry a reasoned `phpcs:ignore`)
+· `contentrain validate` 14 models, 62 entries · canonical byte parity 55 files
+· 5 documents carry frontmatter · handoff, reader and uninstall pass · archive
+33 runtime files · `composer lint` 0 errors / 0 warnings on 27 packaged files.
 
 ## The reader gate
 
@@ -158,7 +160,8 @@ another green CI run.
 
 Plugin Check 2.1.0 (all categories, including plugin_repo and security) on the 0.6.5 release zip: zero errors,
 26 warnings, in three classes. Since 0.7.0 each direct query carries a `phpcs:ignore` with its reason on its own line,
-so the run shows only the first class. Reviewers accept all three with a stated reason; do not silence them by
+and since 0.7.1 the WPML hook names do too, so the run shows none of them; `composer lint:all -- --report=source`
+in CI lists every ignored sniff. Reviewers accept all three with a stated reason; do not silence them by
 weakening the check.
 
 - **Third-party hook names (4):** `wpml_default_language`, `wpml_post_language_details`, `wpml_element_trid` and
diff --git a/assets/admin.js b/assets/admin.js
index feb3001..4b6f6f3 100644
--- a/assets/admin.js
+++ b/assets/admin.js
@@ -14,8 +14,23 @@
   const STEP_TIMEOUT = 120000;
   const wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
   function retryable(message) { return Object.assign(new Error(message), { retryable: true }); }
+  /**
+   * The request as plain form fields, one per value, the way PHP reads them: a list as `name[]`, an object as
+   * `name[key]`, a flag as 1 or 0. The server reads each field once with the function for its type; no JSON blob.
+   */
+  function fields(payload, body = new URLSearchParams(), prefix = '') {
+    for (const [name, value] of Object.entries(payload)) {
+      const key = prefix ? `${prefix}[${name}]` : name;
+      if (value === null || value === undefined) continue;
+      if (Array.isArray(value)) value.forEach((item) => body.append(`${key}[]`, String(item)));
+      else if (typeof value === 'object') fields(value, body, key);
+      else if (typeof value === 'boolean') body.append(key, value ? '1' : '0');
+      else body.append(key, String(value));
+    }
+    return body;
+  }
   async function api(payload, timeout = 0) {
-    const body = new URLSearchParams({ action: 'contentrain_bridge', nonce: ContentrainBridge.nonce, payload: JSON.stringify(payload) });
+    const body = fields({ action: 'contentrain_bridge', nonce: ContentrainBridge.nonce, ...payload });
     const controller = new AbortController();
     const timer = timeout ? setTimeout(() => controller.abort(), timeout) : 0;
     let response;
diff --git a/composer.json b/composer.json
new file mode 100644
index 0000000..0d8fe69
--- /dev/null
+++ b/composer.json
@@ -0,0 +1,24 @@
+{
+    "name": "contentrain/wordpress-bridge",
+    "description": "Development dependencies for Contentrain Bridge: coding-standards checks. Not part of the installed plugin.",
+    "type": "wordpress-plugin",
+    "license": "GPL-2.0-or-later",
+    "require": {
+        "php": ">=7.4"
+    },
+    "require-dev": {
+        "dealerdirect/phpcodesniffer-composer-installer": "^1.0",
+        "wp-coding-standards/wpcs": "^3.1",
+        "phpcompatibility/phpcompatibility-wp": "^2.1"
+    },
+    "scripts": {
+        "lint": "phpcs --standard=phpcs.xml.dist",
+        "lint:all": "phpcs --standard=phpcs.xml.dist --ignore-annotations"
+    },
+    "config": {
+        "allow-plugins": {
+            "dealerdirect/phpcodesniffer-composer-installer": true
+        },
+        "sort-packages": true
+    }
+}
diff --git a/composer.lock b/composer.lock
new file mode 100644
index 0000000..2f3a423
--- /dev/null
+++ b/composer.lock
@@ -0,0 +1,650 @@
+{
+    "_readme": [
+        "This file locks the dependencies of your project to a known state",
+        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
+        "This file is @generated automatically"
+    ],
+    "content-hash": "7cfdcfca035b0dddb959018898dd48d8",
+    "packages": [],
+    "packages-dev": [
+        {
+            "name": "dealerdirect/phpcodesniffer-composer-installer",
+            "version": "v1.2.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/PHPCSStandards/composer-installer.git",
+                "reference": "963f0c67bffde0eac41b56be71ac0e8ba132f0bd"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/PHPCSStandards/composer-installer/zipball/963f0c67bffde0eac41b56be71ac0e8ba132f0bd",
+                "reference": "963f0c67bffde0eac41b56be71ac0e8ba132f0bd",
+                "shasum": ""
+            },
+            "require": {
+                "composer-plugin-api": "^2.2",
+                "php": ">=5.4",
+                "squizlabs/php_codesniffer": "^3.1.0 || ^4.0"
+            },
+            "require-dev": {
+                "composer/composer": "^2.2",
+                "ext-json": "*",
+                "ext-zip": "*",
+                "php-parallel-lint/php-parallel-lint": "^1.4.0",
+                "phpcompatibility/php-compatibility": "^9.0 || ^10.0.0@dev",
+                "yoast/phpunit-polyfills": "^1.0"
+            },
+            "type": "composer-plugin",
+            "extra": {
+                "class": "PHPCSStandards\\Composer\\Plugin\\Installers\\PHPCodeSniffer\\Plugin"
+            },
+            "autoload": {
+                "psr-4": {
+                    "PHPCSStandards\\Composer\\Plugin\\Installers\\PHPCodeSniffer\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Franck Nijhof",
+                    "email": "opensource@frenck.dev",
+                    "homepage": "https://frenck.dev",
+                    "role": "Open source developer"
+                },
+                {
+                    "name": "Contributors",
+                    "homepage": "https://github.com/PHPCSStandards/composer-installer/graphs/contributors"
+                }
+            ],
+            "description": "PHP_CodeSniffer Standards Composer Installer Plugin",
+            "keywords": [
+                "PHPCodeSniffer",
+                "PHP_CodeSniffer",
+                "code quality",
+                "codesniffer",
+                "composer",
+                "installer",
+                "phpcbf",
+                "phpcs",
+                "plugin",
+                "qa",
+                "quality",
+                "standard",
+                "standards",
+                "style guide",
+                "stylecheck",
+                "tests"
+            ],
+            "support": {
+                "issues": "https://github.com/PHPCSStandards/composer-installer/issues",
+                "security": "https://github.com/PHPCSStandards/composer-installer/security/policy",
+                "source": "https://github.com/PHPCSStandards/composer-installer"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/PHPCSStandards",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/jrfnl",
+                    "type": "github"
+                },
+                {
+                    "url": "https://opencollective.com/php_codesniffer",
+                    "type": "open_collective"
+                },
+                {
+                    "url": "https://thanks.dev/u/gh/phpcsstandards",
+                    "type": "thanks_dev"
+                }
+            ],
+            "time": "2026-05-06T08:26:05+00:00"
+        },
+        {
+            "name": "phpcompatibility/php-compatibility",
+            "version": "9.3.5",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/PHPCompatibility/PHPCompatibility.git",
+                "reference": "9fb324479acf6f39452e0655d2429cc0d3914243"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/PHPCompatibility/PHPCompatibility/zipball/9fb324479acf6f39452e0655d2429cc0d3914243",
+                "reference": "9fb324479acf6f39452e0655d2429cc0d3914243",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=5.3",
+                "squizlabs/php_codesniffer": "^2.3 || ^3.0.2"
+            },
+            "conflict": {
+                "squizlabs/php_codesniffer": "2.6.2"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "~4.5 || ^5.0 || ^6.0 || ^7.0"
+            },
+            "suggest": {
+                "dealerdirect/phpcodesniffer-composer-installer": "^0.5 || This Composer plugin will sort out the PHPCS 'installed_paths' automatically.",
+                "roave/security-advisories": "dev-master || Helps prevent installing dependencies with known security issues."
+            },
+            "type": "phpcodesniffer-standard",
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "LGPL-3.0-or-later"
+            ],
+            "authors": [
+                {
+                    "name": "Wim Godden",
+                    "homepage": "https://github.com/wimg",
+                    "role": "lead"
+                },
+                {
+                    "name": "Juliette Reinders Folmer",
+                    "homepage": "https://github.com/jrfnl",
+                    "role": "lead"
+                },
+                {
+                    "name": "Contributors",
+                    "homepage": "https://github.com/PHPCompatibility/PHPCompatibility/graphs/contributors"
+                }
+            ],
+            "description": "A set of sniffs for PHP_CodeSniffer that checks for PHP cross-version compatibility.",
+            "homepage": "http://techblog.wimgodden.be/tag/codesniffer/",
+            "keywords": [
+                "compatibility",
+                "phpcs",
+                "standards"
+            ],
+            "support": {
+                "issues": "https://github.com/PHPCompatibility/PHPCompatibility/issues",
+                "source": "https://github.com/PHPCompatibility/PHPCompatibility"
+            },
+            "time": "2019-12-27T09:44:58+00:00"
+        },
+        {
+            "name": "phpcompatibility/phpcompatibility-paragonie",
+            "version": "1.3.4",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/PHPCompatibility/PHPCompatibilityParagonie.git",
+                "reference": "244d7b04fc4bc2117c15f5abe23eb933b5f02bbf"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/PHPCompatibility/PHPCompatibilityParagonie/zipball/244d7b04fc4bc2117c15f5abe23eb933b5f02bbf",
+                "reference": "244d7b04fc4bc2117c15f5abe23eb933b5f02bbf",
+                "shasum": ""
+            },
+            "require": {
+                "phpcompatibility/php-compatibility": "^9.0"
+            },
+            "require-dev": {
+                "dealerdirect/phpcodesniffer-composer-installer": "^1.0",
+                "paragonie/random_compat": "dev-master",
+                "paragonie/sodium_compat": "dev-master"
+            },
+            "suggest": {
+                "dealerdirect/phpcodesniffer-composer-installer": "^1.0 || This Composer plugin will sort out the PHP_CodeSniffer 'installed_paths' automatically.",
+                "roave/security-advisories": "dev-master || Helps prevent installing dependencies with known security issues."
+            },
+            "type": "phpcodesniffer-standard",
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "LGPL-3.0-or-later"
+            ],
+            "authors": [
+                {
+                    "name": "Wim Godden",
+                    "role": "lead"
+                },
+                {
+                    "name": "Juliette Reinders Folmer",
+                    "role": "lead"
+                }
+            ],
+            "description": "A set of rulesets for PHP_CodeSniffer to check for PHP cross-version compatibility issues in projects, while accounting for polyfills provided by the Paragonie polyfill libraries.",
+            "homepage": "http://phpcompatibility.com/",
+            "keywords": [
+                "compatibility",
+                "paragonie",
+                "phpcs",
+                "polyfill",
+                "standards",
+                "static analysis"
+            ],
+            "support": {
+                "issues": "https://github.com/PHPCompatibility/PHPCompatibilityParagonie/issues",
+                "security": "https://github.com/PHPCompatibility/PHPCompatibilityParagonie/security/policy",
+                "source": "https://github.com/PHPCompatibility/PHPCompatibilityParagonie"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/PHPCompatibility",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/jrfnl",
+                    "type": "github"
+                },
+                {
+                    "url": "https://opencollective.com/php_codesniffer",
+                    "type": "open_collective"
+                },
+                {
+                    "url": "https://thanks.dev/u/gh/phpcompatibility",
+                    "type": "thanks_dev"
+                }
+            ],
+            "time": "2025-09-19T17:43:28+00:00"
+        },
+        {
+            "name": "phpcompatibility/phpcompatibility-wp",
+            "version": "2.1.8",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/PHPCompatibility/PHPCompatibilityWP.git",
+                "reference": "7c8d18b4d90dac9e86b0869a608fa09158e168fa"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/PHPCompatibility/PHPCompatibilityWP/zipball/7c8d18b4d90dac9e86b0869a608fa09158e168fa",
+                "reference": "7c8d18b4d90dac9e86b0869a608fa09158e168fa",
+                "shasum": ""
+            },
+            "require": {
+                "phpcompatibility/php-compatibility": "^9.0",
+                "phpcompatibility/phpcompatibility-paragonie": "^1.0",
+                "squizlabs/php_codesniffer": "^3.3"
+            },
+            "require-dev": {
+                "dealerdirect/phpcodesniffer-composer-installer": "^1.0"
+            },
+            "suggest": {
+                "dealerdirect/phpcodesniffer-composer-installer": "^1.0 || This Composer plugin will sort out the PHP_CodeSniffer 'installed_paths' automatically.",
+                "roave/security-advisories": "dev-master || Helps prevent installing dependencies with known security issues."
+            },
+            "type": "phpcodesniffer-standard",
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "LGPL-3.0-or-later"
+            ],
+            "authors": [
+                {
+                    "name": "Wim Godden",
+                    "role": "lead"
+                },
+                {
+                    "name": "Juliette Reinders Folmer",
+                    "role": "lead"
+                }
+            ],
+            "description": "A ruleset for PHP_CodeSniffer to check for PHP cross-version compatibility issues in projects, while accounting for polyfills provided by WordPress.",
+            "homepage": "http://phpcompatibility.com/",
+            "keywords": [
+                "compatibility",
+                "phpcs",
+                "standards",
+                "static analysis",
+                "wordpress"
+            ],
+            "support": {
+                "issues": "https://github.com/PHPCompatibility/PHPCompatibilityWP/issues",
+                "security": "https://github.com/PHPCompatibility/PHPCompatibilityWP/security/policy",
+                "source": "https://github.com/PHPCompatibility/PHPCompatibilityWP"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/PHPCompatibility",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/jrfnl",
+                    "type": "github"
+                },
+                {
+                    "url": "https://opencollective.com/php_codesniffer",
+                    "type": "open_collective"
+                },
+                {
+                    "url": "https://thanks.dev/u/gh/phpcompatibility",
+                    "type": "thanks_dev"
+                }
+            ],
+            "time": "2025-10-18T00:05:59+00:00"
+        },
+        {
+            "name": "phpcsstandards/phpcsextra",
+            "version": "1.5.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/PHPCSStandards/PHPCSExtra.git",
+                "reference": "39467533fdb742446d68c1d10ac33d625ee0311c"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/PHPCSStandards/PHPCSExtra/zipball/39467533fdb742446d68c1d10ac33d625ee0311c",
+                "reference": "39467533fdb742446d68c1d10ac33d625ee0311c",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=5.4",
+                "phpcsstandards/phpcsutils": "^1.2.3",
+                "squizlabs/php_codesniffer": "^3.13.5 || ^4.0.1"
+            },
+            "require-dev": {
+                "php-parallel-lint/php-console-highlighter": "^1.0",
+                "php-parallel-lint/php-parallel-lint": "^1.4.0",
+                "phpcsstandards/phpcsdevcs": "^1.2.0",
+                "phpcsstandards/phpcsdevtools": "^1.2.1",
+                "phpunit/phpunit": "^4.5 || ^5.0 || ^6.0 || ^7.0 || ^8.0 || ^9.3.4"
+            },
+            "type": "phpcodesniffer-standard",
+            "extra": {
+                "branch-alias": {
+                    "dev-stable": "1.x-dev",
+                    "dev-develop": "1.x-dev"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "LGPL-3.0-or-later"
+            ],
+            "authors": [
+                {
+                    "name": "Juliette Reinders Folmer",
+                    "homepage": "https://github.com/jrfnl",
+                    "role": "lead"
+                },
+                {
+                    "name": "Contributors",
+                    "homepage": "https://github.com/PHPCSStandards/PHPCSExtra/graphs/contributors"
+                }
+            ],
+            "description": "A collection of sniffs and standards for use with PHP_CodeSniffer.",
+            "keywords": [
+                "PHP_CodeSniffer",
+                "phpcbf",
+                "phpcodesniffer-standard",
+                "phpcs",
+                "standards",
+                "static analysis"
+            ],
+            "support": {
+                "issues": "https://github.com/PHPCSStandards/PHPCSExtra/issues",
+                "security": "https://github.com/PHPCSStandards/PHPCSExtra/security/policy",
+                "source": "https://github.com/PHPCSStandards/PHPCSExtra"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/PHPCSStandards",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/jrfnl",
+                    "type": "github"
+                },
+                {
+                    "url": "https://opencollective.com/php_codesniffer",
+                    "type": "open_collective"
+                },
+                {
+                    "url": "https://thanks.dev/u/gh/phpcsstandards",
+                    "type": "thanks_dev"
+                }
+            ],
+            "time": "2026-07-27T11:13:17+00:00"
+        },
+        {
+            "name": "phpcsstandards/phpcsutils",
+            "version": "1.2.3",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/PHPCSStandards/PHPCSUtils.git",
+                "reference": "5f35d9408c54d7b529501f3c688b6eae562aea1f"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/PHPCSStandards/PHPCSUtils/zipball/5f35d9408c54d7b529501f3c688b6eae562aea1f",
+                "reference": "5f35d9408c54d7b529501f3c688b6eae562aea1f",
+                "shasum": ""
+            },
+            "require": {
+                "dealerdirect/phpcodesniffer-composer-installer": "^0.4.1 || ^0.5 || ^0.6.2 || ^0.7 || ^1.0",
+                "php": ">=5.4",
+                "squizlabs/php_codesniffer": "^3.13.5 || ^4.0.1"
+            },
+            "require-dev": {
+                "ext-filter": "*",
+                "php-parallel-lint/php-console-highlighter": "^1.0",
+                "php-parallel-lint/php-parallel-lint": "^1.4.0",
+                "phpcsstandards/phpcsdevcs": "^1.2.0",
+                "yoast/phpunit-polyfills": "^1.1.0 || ^2.0.0 || ^3.0.0"
+            },
+            "type": "phpcodesniffer-standard",
+            "extra": {
+                "branch-alias": {
+                    "dev-stable": "1.x-dev",
+                    "dev-develop": "1.x-dev"
+                }
+            },
+            "autoload": {
+                "classmap": [
+                    "PHPCSUtils/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "LGPL-3.0-or-later"
+            ],
+            "authors": [
+                {
+                    "name": "Juliette Reinders Folmer",
+                    "homepage": "https://github.com/jrfnl",
+                    "role": "lead"
+                },
+                {
+                    "name": "Contributors",
+                    "homepage": "https://github.com/PHPCSStandards/PHPCSUtils/graphs/contributors"
+                }
+            ],
+            "description": "A suite of utility functions for use with PHP_CodeSniffer",
+            "homepage": "https://phpcsutils.com/",
+            "keywords": [
+                "PHP_CodeSniffer",
+                "phpcbf",
+                "phpcodesniffer-standard",
+                "phpcs",
+                "phpcs3",
+                "phpcs4",
+                "standards",
+                "static analysis",
+                "tokens",
+                "utility"
+            ],
+            "support": {
+                "docs": "https://phpcsutils.com/",
+                "issues": "https://github.com/PHPCSStandards/PHPCSUtils/issues",
+                "security": "https://github.com/PHPCSStandards/PHPCSUtils/security/policy",
+                "source": "https://github.com/PHPCSStandards/PHPCSUtils"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/PHPCSStandards",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/jrfnl",
+                    "type": "github"
+                },
+                {
+                    "url": "https://opencollective.com/php_codesniffer",
+                    "type": "open_collective"
+                },
+                {
+                    "url": "https://thanks.dev/u/gh/phpcsstandards",
+                    "type": "thanks_dev"
+                }
+            ],
+            "time": "2026-07-27T10:28:41+00:00"
+        },
+        {
+            "name": "squizlabs/php_codesniffer",
+            "version": "3.13.6",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/PHPCSStandards/PHP_CodeSniffer.git",
+                "reference": "4c378e1a528ea066890fc2397cbdd2f94eb2fc91"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/4c378e1a528ea066890fc2397cbdd2f94eb2fc91",
+                "reference": "4c378e1a528ea066890fc2397cbdd2f94eb2fc91",
+                "shasum": ""
+            },
+            "require": {
+                "ext-simplexml": "*",
+                "ext-tokenizer": "*",
+                "ext-xmlwriter": "*",
+                "php": ">=5.4.0"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^4.0 || ^5.0 || ^6.0 || ^7.0 || ^8.0 || ^9.3.4"
+            },
+            "bin": [
+                "bin/phpcbf",
+                "bin/phpcs"
+            ],
+            "type": "library",
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Greg Sherwood",
+                    "role": "Former lead"
+                },
+                {
+                    "name": "Juliette Reinders Folmer",
+                    "role": "Current lead"
+                },
+                {
+                    "name": "Contributors",
+                    "homepage": "https://github.com/PHPCSStandards/PHP_CodeSniffer/graphs/contributors"
+                }
+            ],
+            "description": "PHP_CodeSniffer tokenizes PHP, JavaScript and CSS files and detects violations of a defined set of coding standards.",
+            "homepage": "https://github.com/PHPCSStandards/PHP_CodeSniffer",
+            "keywords": [
+                "phpcs",
+                "standards",
+                "static analysis"
+            ],
+            "support": {
+                "issues": "https://github.com/PHPCSStandards/PHP_CodeSniffer/issues",
+                "security": "https://github.com/PHPCSStandards/PHP_CodeSniffer/security/policy",
+                "source": "https://github.com/PHPCSStandards/PHP_CodeSniffer",
+                "wiki": "https://github.com/PHPCSStandards/PHP_CodeSniffer/wiki"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/PHPCSStandards",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/jrfnl",
+                    "type": "github"
+                },
+                {
+                    "url": "https://opencollective.com/php_codesniffer",
+                    "type": "open_collective"
+                },
+                {
+                    "url": "https://thanks.dev/u/gh/phpcsstandards",
+                    "type": "thanks_dev"
+                }
+            ],
+            "time": "2026-08-06T00:17:32+00:00"
+        },
+        {
+            "name": "wp-coding-standards/wpcs",
+            "version": "3.4.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/WordPress/WordPress-Coding-Standards.git",
+                "reference": "ec2ff942335f33683a5957a85d138753876a05cf"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/WordPress/WordPress-Coding-Standards/zipball/ec2ff942335f33683a5957a85d138753876a05cf",
+                "reference": "ec2ff942335f33683a5957a85d138753876a05cf",
+                "shasum": ""
+            },
+            "require": {
+                "ext-filter": "*",
+                "ext-libxml": "*",
+                "ext-tokenizer": "*",
+                "ext-xmlreader": "*",
+                "php": ">=7.2",
+                "phpcsstandards/phpcsextra": "^1.5.1",
+                "phpcsstandards/phpcsutils": "^1.2.3",
+                "squizlabs/php_codesniffer": "^3.13.5"
+            },
+            "require-dev": {
+                "php-parallel-lint/php-console-highlighter": "^1.0.0",
+                "php-parallel-lint/php-parallel-lint": "^1.4.0",
+                "phpcompatibility/php-compatibility": "^10.0.0@dev",
+                "phpcsstandards/phpcsdevtools": "^1.2.0",
+                "phpunit/phpunit": "^8.0 || ^9.0"
+            },
+            "suggest": {
+                "ext-iconv": "For improved results",
+                "ext-mbstring": "For improved results"
+            },
+            "type": "phpcodesniffer-standard",
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Contributors",
+                    "homepage": "https://github.com/WordPress/WordPress-Coding-Standards/graphs/contributors"
+                }
+            ],
+            "description": "PHP_CodeSniffer rules (sniffs) to enforce WordPress coding conventions",
+            "keywords": [
+                "phpcs",
+                "standards",
+                "static analysis",
+                "wordpress"
+            ],
+            "support": {
+                "issues": "https://github.com/WordPress/WordPress-Coding-Standards/issues",
+                "source": "https://github.com/WordPress/WordPress-Coding-Standards",
+                "wiki": "https://github.com/WordPress/WordPress-Coding-Standards/wiki"
+            },
+            "funding": [
+                {
+                    "url": "https://opencollective.com/php_codesniffer",
+                    "type": "custom"
+                }
+            ],
+            "time": "2026-07-27T11:53:23+00:00"
+        }
+    ],
+    "aliases": [],
+    "minimum-stability": "stable",
+    "stability-flags": {},
+    "prefer-stable": false,
+    "prefer-lowest": false,
+    "platform": {
+        "php": ">=7.4"
+    },
+    "platform-dev": {},
+    "plugin-api-version": "2.9.0"
+}
diff --git a/contentrain-bridge.php b/contentrain-bridge.php
index d3732b0..46b6b2d 100644
--- a/contentrain-bridge.php
+++ b/contentrain-bridge.php
@@ -3,7 +3,7 @@
  * Plugin Name:       Contentrain Bridge
  * Plugin URI:        https://github.com/Contentrain/wordpress-bridge
  * Description:       Model and export WordPress content and interface text as Contentrain JSON/Markdown, with optional GitHub delivery.
- * Version:           0.7.0
+ * Version:           0.7.1
  * Requires at least: 6.2
  * Requires PHP:      7.4
  * Author:            Contentrain
@@ -16,7 +16,7 @@
  */
 
 defined( 'ABSPATH' ) || exit;
-define( 'CONTENTRAIN_BRIDGE_VERSION', '0.7.0' );
+define( 'CONTENTRAIN_BRIDGE_VERSION', '0.7.1' );
 define( 'CONTENTRAIN_BRIDGE_FILE', __FILE__ );
 
 foreach ( array( 'policy', 'files', 'exporter', 'menus', 'source', 'inventory', 'delta', 'seo-render', 'seo', 'redirects', 'routing', 'scanner', 'text', 'coverage', 'integrations', 'acf', 'models', 'validator', 'rawir', 'jobs', 'github', 'key', 'remote', 'robots', 'admin' ) as $contentrain_bridge_class ) {
@@ -25,6 +25,7 @@
 unset( $contentrain_bridge_class );
 
 \Contentrain\Bridge\Admin::register();
+\Contentrain\Bridge\Key::register();
 \Contentrain\Bridge\Robots::register();
 foreach ( array( 'save_post', 'deleted_post', 'added_post_meta', 'updated_post_meta', 'deleted_post_meta', 'created_term', 'edited_term', 'delete_term', 'added_term_meta', 'updated_term_meta', 'deleted_term_meta', 'comment_post', 'edit_comment', 'deleted_comment', 'transition_comment_status', 'profile_update', 'switch_theme' ) as $contentrain_bridge_hook ) {
 	add_action( $contentrain_bridge_hook, array( '\Contentrain\Bridge\Source', 'changed' ), 10, 3 );
diff --git a/includes/class-contentrain-bridge-acf.php b/includes/class-contentrain-bridge-acf.php
index bfa4abb..30fa026 100644
--- a/includes/class-contentrain-bridge-acf.php
+++ b/includes/class-contentrain-bridge-acf.php
@@ -155,7 +155,7 @@ private static function page_address( $post_id ) {
 				return null;
 			}
 		}
-		return get_permalink( $post ) ?: null;
+		return Source::permalink( $post ) ?: null;
 	}
 
 	/**
diff --git a/includes/class-contentrain-bridge-admin.php b/includes/class-contentrain-bridge-admin.php
index 4134cda..d294458 100644
--- a/includes/class-contentrain-bridge-admin.php
+++ b/includes/class-contentrain-bridge-admin.php
@@ -63,8 +63,10 @@ public static function page() {
 			<p><?php esc_html_e( 'Your WordPress site stays as it is. Review the content models and interface text before downloading or sending anything to GitHub.', 'contentrain-bridge' ); ?></p>
 			<section id="cr-connect" class="card cr-card">
 				<?php self::heading( 'admin-links', __( 'Connect to Contentrain Migrate', 'contentrain-bridge' ) ); ?>
-				<p><?php esc_html_e( 'Moving this site with Contentrain Migrate? Create a connection key and paste it into Migrate. It lets Migrate start and read content exports of this site as you, nothing else, and works where your host blocks application passwords.', 'contentrain-bridge' ); ?></p>
-				<p><?php esc_html_e( 'The key is shown once; only a fingerprint of it is stored. Paste it into Migrate within an hour. Once Migrate has used it, it works for that one move until 14 days after it was created, until Migrate closes it when the move is done, or until you revoke it or create a new one.', 'contentrain-bridge' ); ?></p>
+				<p><?php esc_html_e( 'Moving this site with Contentrain Migrate? Create a connection key and paste it into Migrate. It works where your host blocks application passwords.', 'contentrain-bridge' ); ?></p>
+				<p><strong><?php esc_html_e( 'What the key allows.', 'contentrain-bridge' ); ?></strong> <?php esc_html_e( 'With this key, Contentrain Migrate can ask this site to prepare a content export and download it. The export contains: published posts, pages and custom post types with their fields and metadata (secret-looking keys are always left out); if Migrate asks for it, draft, pending, scheduled, private and password-protected content too (never the password itself); media records (the files only if requested); categories, tags and menus; comments without email addresses or IP addresses; SEO, redirect and permalink settings; theme design settings; the names and versions of active plugins and the theme; and the number of published entries per content type.', 'contentrain-bridge' ); ?></p>
+				<p><strong><?php esc_html_e( 'What the key cannot do.', 'contentrain-bridge' ); ?></strong> <?php esc_html_e( 'It runs with no WordPress user. It cannot change anything on this site: no post, setting, file, user, plugin or theme is written. It does not open the WordPress REST API, wp-admin or application passwords; it works only on the plugin\'s own export routes. The only things recorded are the time and address of its last use.', 'contentrain-bridge' ); ?></p>
+				<p><strong><?php esc_html_e( 'Revoking.', 'contentrain-bridge' ); ?></strong> <?php esc_html_e( 'Revoke it here at any time; creating a new key retires the old one, and revoking removes the exports it prepared. The key is shown once; only a fingerprint of it is stored. An unused key expires an hour after creation; once Migrate has used it, it works for that one move for up to 14 days, and Migrate closes it itself when the move is done. It can only be created and used over HTTPS.', 'contentrain-bridge' ); ?></p>
 				<p id="cr-key-state" role="status" aria-live="polite"></p>
 				<div id="cr-key-new" hidden>
 					<label for="cr-key"><?php esc_html_e( 'Your connection key — copy it now, it will not be shown again', 'contentrain-bridge' ); ?></label>
@@ -211,45 +213,97 @@ private static function robots_card() {
 		<?php
 	}
 
+	/** The operations the screen's script can ask for. */
+	const OPS = array( 'inventory', 'create', 'status', 'step', 'candidates', 'review', 'github-start', 'github-step', 'coverage', 'zip', 'key-status', 'key-create', 'key-revoke', 'delete' );
+
+	/**
+	 * What the screen's script sent, as plain form fields, each read once with the function for its type (after the
+	 * nonce). Nothing else from the request reaches an operation: the `switch` in `ajax()` consumes this array only.
+	 */
+	private static function input() {
+		// phpcs:disable WordPress.Security.NonceVerification.Missing -- check_ajax_referer() ran in ajax() before this is called.
+		$in = array();
+		$in['op'] = isset( $_POST['op'] ) ? sanitize_key( wp_unslash( $_POST['op'] ) ) : '';
+		if ( ! in_array( $in['op'], self::OPS, true ) ) {
+			throw new \RuntimeException( 'Unknown operation.' );
+		}
+		$in['id'] = isset( $_POST['id'] ) ? sanitize_text_field( wp_unslash( $_POST['id'] ) ) : '';
+		if ( '' !== $in['id'] && ! preg_match( '/^[a-f0-9]{32}$/D', $in['id'] ) ) {
+			throw new \RuntimeException( 'Invalid export identifier.' );
+		}
+		foreach ( array( 'step', 'offset', 'cursor' ) as $number ) {
+			// -1: "not sent", which Jobs::advance / GitHub::step read as "no step expected".
+			$in[ $number ] = isset( $_POST[ $number ] ) ? absint( wp_unslash( $_POST[ $number ] ) ) : -1;
+		}
+		foreach ( array( 'finish', 'consent', 'private', 'comments', 'media_files', 'scan_sources', 'scan_render', 'scan_plugins' ) as $flag ) {
+			$in[ $flag ] = isset( $_POST[ $flag ] ) ? rest_sanitize_boolean( sanitize_text_field( wp_unslash( $_POST[ $flag ] ) ) ) : false;
+		}
+		// Absent means none chosen (the screen sends one field per checked type), never "every type".
+		$in['types'] = isset( $_POST['types'] ) && is_array( $_POST['types'] ) ? array_values( array_filter( array_map( 'sanitize_key', wp_unslash( $_POST['types'] ) ) ) ) : array();
+		$in['selected_meta'] = isset( $_POST['selected_meta'] ) && is_array( $_POST['selected_meta'] ) ? array_values( array_filter( array_map( 'sanitize_text_field', wp_unslash( $_POST['selected_meta'] ) ) ) ) : array();
+		// labels[<type>] = <label>: one string per type name.
+		$in['labels'] = array();
+		if ( isset( $_POST['labels'] ) && is_array( $_POST['labels'] ) ) {
+			foreach ( map_deep( wp_unslash( $_POST['labels'] ), 'sanitize_text_field' ) as $type => $label ) {
+				if ( is_string( $label ) ) {
+					$in['labels'][ sanitize_key( $type ) ] = $label;
+				}
+			}
+		}
+		// decisions[<candidate id>][decision|key]: Jobs::review() checks each against the export's own candidates.
+		$in['decisions'] = array();
+		if ( isset( $_POST['decisions'] ) && is_array( $_POST['decisions'] ) ) {
+			foreach ( map_deep( wp_unslash( $_POST['decisions'] ), 'sanitize_text_field' ) as $candidate => $decision ) {
+				if ( is_array( $decision ) && preg_match( '/^[A-Za-z0-9_.:-]{1,200}$/D', (string) $candidate ) ) {
+					$in['decisions'][ (string) $candidate ] = array_intersect_key( $decision, array( 'decision' => 1, 'key' => 1 ) );
+				}
+			}
+		}
+		// The token is a credential: whitespace-free and bounded, which GitHub::start() checks again; never logged or stored.
+		$in['token'] = isset( $_POST['token'] ) ? trim( sanitize_text_field( wp_unslash( $_POST['token'] ) ) ) : '';
+		$in['repository'] = isset( $_POST['repository'] ) ? sanitize_text_field( wp_unslash( $_POST['repository'] ) ) : '';
+		$in['base_branch'] = isset( $_POST['base_branch'] ) ? sanitize_text_field( wp_unslash( $_POST['base_branch'] ) ) : '';
+		$choice = isset( $_POST['on_conflict'] ) ? sanitize_key( wp_unslash( $_POST['on_conflict'] ) ) : 'refuse';
+		$in['on_conflict'] = in_array( $choice, GitHub::CONFLICT_CHOICES, true ) ? $choice : 'refuse';
+		// phpcs:enable WordPress.Security.NonceVerification.Missing
+		return $in;
+	}
+
 	public static function ajax() {
 		if ( ! self::permitted() ) {
 			wp_send_json_error( array( 'message' => __( 'Permission denied.', 'contentrain-bridge' ) ), 403 );
 		}
 		check_ajax_referer( 'contentrain_bridge', 'nonce' );
 		try {
-			$input = isset( $_POST['payload'] ) ? json_decode( wp_unslash( $_POST['payload'] ), true ) : array(); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Typed operation validation below; arbitrary content is not rendered.
-			if ( ! is_array( $input ) ) {
-				throw new \RuntimeException( 'Invalid request.' );
-			}
-			$op = $input['op'] ?? '';
-			$id = $input['id'] ?? '';
-			switch ( $op ) {
+			$in = self::input();
+			$id = $in['id'];
+			switch ( $in['op'] ) {
 				case 'inventory':
 					$result = Source::inventory();
 					$result['active_job'] = get_user_meta( get_current_user_id(), 'contentrain_bridge_job_' . get_current_blog_id(), true );
 					break;
-				case 'create': $result = Jobs::create( $input ); break;
+				case 'create': $result = Jobs::create( array_intersect_key( $in, array_flip( array( 'types', 'labels', 'private', 'comments', 'media_files', 'scan_sources', 'scan_render', 'scan_plugins', 'selected_meta' ) ) ) ); break;
 				case 'status': $result = Jobs::summary( Jobs::read( $id ) ); break;
-				case 'step': $result = Jobs::advance( $id, $input['step'] ?? -1 ); break;
+				case 'step': $result = Jobs::advance( $id, $in['step'] ); break;
 				case 'candidates':
 					$job = Jobs::read( $id );
-					$result = array_slice( array_values( $job['candidates'] ), max( 0, (int) ( $input['offset'] ?? 0 ) ), 30 );
+					$result = array_slice( array_values( $job['candidates'] ), max( 0, $in['offset'] ), 30 );
 					break;
-				case 'review': $result = Jobs::review( $id, (array) ( $input['decisions'] ?? array() ), ! empty( $input['finish'] ) ); break;
+				case 'review': $result = Jobs::review( $id, $in['decisions'], $in['finish'] ); break;
 				case 'github-start':
 					if ( ! is_ssl() && 'local' !== wp_get_environment_type() ) {
 						throw new \RuntimeException( 'Use HTTPS in WordPress administration before sending a GitHub credential.' );
 					}
-					if ( empty( $input['consent'] ) ) {
+					if ( ! $in['consent'] ) {
 						throw new \RuntimeException( 'Explicit GitHub transfer consent is required.' );
 					}
-					$result = GitHub::start( $id, $input['token'] ?? '', $input['repository'] ?? '', in_array( $input['on_conflict'] ?? 'refuse', GitHub::CONFLICT_CHOICES, true ) ? $input['on_conflict'] : 'refuse', is_string( $input['base_branch'] ?? null ) ? $input['base_branch'] : '' );
+					$result = GitHub::start( $id, $in['token'], $in['repository'], $in['on_conflict'], $in['base_branch'] );
 					break;
 				case 'github-step':
 					if ( ! is_ssl() && 'local' !== wp_get_environment_type() ) {
 						throw new \RuntimeException( 'Use HTTPS in WordPress administration before sending a GitHub credential.' );
 					}
-					$result = GitHub::step( $id, $input['token'] ?? '', $input['cursor'] ?? -1 ); break;
+					$result = GitHub::step( $id, $in['token'], $in['cursor'] ); break;
 				case 'coverage':
 					$job = Jobs::read( $id );
 					if ( 'ready' !== $job['phase'] || ! isset( $job['files']['bridge/coverage.json'] ) ) {
@@ -317,6 +371,9 @@ public static function download() {
 		check_admin_referer( 'contentrain_bridge_download' );
 		try {
 			$id = isset( $_GET['id'] ) ? sanitize_text_field( wp_unslash( $_GET['id'] ) ) : '';
+			if ( ! preg_match( '/^[a-f0-9]{32}$/D', $id ) ) {
+				throw new \RuntimeException( 'Invalid export identifier.' );
+			}
 			$job = Jobs::read( $id );
 			if ( 'ready' !== $job['phase'] || ( $job['zip_cursor'] ?? 0 ) < count( $job['files'] ) ) {
 				throw new \RuntimeException( 'ZIP is not ready.' );
@@ -335,12 +392,33 @@ public static function download() {
 	}
 
 	public static function routes() {
-		register_rest_route( 'contentrain-bridge/v1', '/exports/(?P<id>[a-f0-9]{32})', array( 'methods' => 'GET', 'permission_callback' => array( Remote::class, 'permitted' ), 'callback' => array( self::class, 'read_export' ) ) );
+		$read = array( 'permission_callback' => array( Remote::class, 'permitted' ), 'callback' => array( self::class, 'read_export' ), 'args' => self::read_args() );
+		register_rest_route( 'contentrain-bridge/v1', '/exports/(?P<id>[a-f0-9]{32})', array( 'methods' => 'GET' ) + $read );
 		// The same read for a caller whose key travels in the body (BR-27): a GET has none.
-		register_rest_route( 'contentrain-bridge/v1', '/exports/(?P<id>[a-f0-9]{32})/read', array( 'methods' => 'POST', 'permission_callback' => array( Remote::class, 'permitted' ), 'callback' => array( self::class, 'read_export' ) ) );
+		register_rest_route( 'contentrain-bridge/v1', '/exports/(?P<id>[a-f0-9]{32})/read', array( 'methods' => 'POST' ) + $read );
 		Remote::routes();
 	}
 
+	/** The read routes' parameters: a snapshot path, and a byte range of at most 8 MiB; `read_chunk()` checks them against the export again. */
+	public static function read_args() {
+		$number = array( 'type' => 'integer', 'sanitize_callback' => 'absint', 'validate_callback' => array( self::class, 'validate_number' ) );
+		return array(
+			'file' => array( 'type' => 'string', 'sanitize_callback' => 'sanitize_text_field', 'validate_callback' => array( self::class, 'validate_path' ) ),
+			'offset' => $number,
+			'length' => $number,
+		) + Remote::key_args();
+	}
+
+	/** A relative snapshot path, as `Files::path()` accepts it. */
+	public static function validate_path( $value ) {
+		return is_string( $value ) && preg_match( '#^[a-zA-Z0-9_.\-/]+$#D', $value ) && ! preg_match( '#(^|/)\.\.?(/|$)#', $value ) && '/' !== substr( $value, 0, 1 );
+	}
+
+	/** Digits only, at most twelve. */
+	public static function validate_number( $value ) {
+		return is_int( $value ) ? $value >= 0 : ( is_string( $value ) && 1 === preg_match( '/^[0-9]{1,12}$/D', $value ) );
+	}
+
 	/**
 	 * GET /exports/{id}: the file list. `?file=`: one file of up to 8 MiB, whole.
 	 * `?file=&offset=N[&length=M]`: any file, in chunks of at most 8 MiB, always
@@ -373,6 +451,7 @@ public static function read_export( $request ) {
 			}
 			$content = Files::read( Files::dir( $job['id'] ) . '/output', $path );
 			$binary = 0 === strpos( $path, 'media/' );
+			// phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode -- Media bytes travel in JSON as base64; the reader verifies the sha256.
 			return new \WP_REST_Response( array( 'path' => $path, 'sha256' => $job['files'][ $path ]['sha256'], 'encoding' => $binary ? 'base64' : 'utf8', 'content' => $binary ? base64_encode( $content ) : $content ), 200, array( 'Cache-Control' => 'private, no-store' ) );
 		} catch ( \Throwable $error ) {
 			return new \WP_Error( 'bridge_export', $error->getMessage(), array( 'status' => 400 ) );
@@ -402,12 +481,14 @@ private static function read_chunk( $job, $path, $offset, $length ) {
 				if ( 0 !== fseek( $stream, $offset ) ) {
 					throw new \RuntimeException( 'Cannot read export file.' );
 				}
-				while ( strlen( $content ) < $length && ! feof( $stream ) ) {
-					$part = fread( $stream, $length - strlen( $content ) ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fread -- Ranged read.
+				$got = 0;
+				while ( $got < $length && ! feof( $stream ) ) {
+					$part = fread( $stream, $length - $got ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fread -- Ranged read.
 					if ( false === $part ) {
 						throw new \RuntimeException( 'Cannot read export file.' );
 					}
 					$content .= $part;
+					$got = strlen( $content );
 				}
 			} finally {
 				fclose( $stream ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- Native stream handle.
@@ -416,10 +497,11 @@ private static function read_chunk( $job, $path, $offset, $length ) {
 				throw new \RuntimeException( 'Export file changed while being read.' );
 			}
 		}
+		// phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode -- A byte range of a file travels in JSON as base64; the reader verifies the sha256.
 		return new \WP_REST_Response( array( 'path' => $path, 'sha256' => $job['files'][ $path ]['sha256'], 'bytes' => $bytes, 'offset' => $offset, 'length' => $length, 'encoding' => 'base64', 'content' => base64_encode( $content ) ), 200, array( 'Cache-Control' => 'private, no-store' ) );
 	}
 
 	public static function privacy() {
-		wp_add_privacy_policy_content( __( 'Contentrain Bridge', 'contentrain-bridge' ), wp_kses_post( __( 'Contentrain Bridge prepares a private, temporary content export after an administrator requests it. Export files expire after 24 hours and may be deleted earlier. Content can contain personal information, including authors\' display names and WordPress usernames; review the scope before sharing. When comments are selected, comments of every status (approved, pending, spam and trash) are included with their status; comment email, IP and metadata are excluded. GitHub transfer is optional and sends the reviewed files to the selected repository only after explicit consent. GitHub credentials are not stored. The optional Migrate link sends no export data. A Contentrain Migrate connection key, when an administrator creates one, lets Contentrain Migrate start and read content exports as that administrator until it expires or is revoked; only a fingerprint of the key and the address and time of its last use are stored. No telemetry is collected.', 'contentrain-bridge' ) ) );
+		wp_add_privacy_policy_content( __( 'Contentrain Bridge', 'contentrain-bridge' ), wp_kses_post( __( 'Contentrain Bridge prepares a private, temporary content export after an administrator requests it. Export files expire after 24 hours and may be deleted earlier. Content can contain personal information, including authors\' display names and WordPress usernames; review the scope before sharing. When comments are selected, comments of every status (approved, pending, spam and trash) are included with their status; comment email, IP and metadata are excluded. GitHub transfer is optional and sends the reviewed files to the selected repository only after explicit consent. GitHub credentials are not stored. The optional Migrate link sends no export data. A Contentrain Migrate connection key, when an administrator creates one, lets Contentrain Migrate prepare and read content exports of this site with no WordPress user and no ability to change the site, until it expires or is revoked; only a fingerprint of the key and the address and time of its last use are stored. No telemetry is collected.', 'contentrain-bridge' ) ) );
 	}
 }
diff --git a/includes/class-contentrain-bridge-coverage.php b/includes/class-contentrain-bridge-coverage.php
index e1fda52..e674dfe 100644
--- a/includes/class-contentrain-bridge-coverage.php
+++ b/includes/class-contentrain-bridge-coverage.php
@@ -355,7 +355,7 @@ private static function bodies( $ids ) {
 	}
 
 	/** Every table in the database with this site's prefix: read, core, derived, or not read. */
-	private static function tables( $job ) {
+	private static function tables( $job ) { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found -- Every source reader takes the job; this one needs only the database.
 		global $wpdb;
 		$outcomes = array();
 		$detail = array();
diff --git a/includes/class-contentrain-bridge-exporter.php b/includes/class-contentrain-bridge-exporter.php
index 56c64ac..4af3899 100644
--- a/includes/class-contentrain-bridge-exporter.php
+++ b/includes/class-contentrain-bridge-exporter.php
@@ -40,7 +40,7 @@ public static function map_post( $post, $selected = array(), &$excluded = array(
 			'status'         => $post->post_status,
 			'slug'           => $post->post_name,
 			'title'          => $post->post_title,
-			'link'           => get_permalink( $post ),
+			'link'           => Source::permalink( $post ),
 			'guid'           => $post->guid,
 			'author'         => $author ? $author->user_login : null,
 			'date'           => self::utc_date( $post->post_date_gmt ),
diff --git a/includes/class-contentrain-bridge-github.php b/includes/class-contentrain-bridge-github.php
index e75b223..70540f8 100644
--- a/includes/class-contentrain-bridge-github.php
+++ b/includes/class-contentrain-bridge-github.php
@@ -20,12 +20,12 @@ public static function request( $token, $method, $path, $body = null ) {
 	 * the exception is created, so the setting holds for it after that.
 	 */
 	private static function without_trace_arguments( callable $work ) {
-		$previous = ini_set( 'zend.exception_ignore_args', '1' ); // phpcs:ignore Squiz.PHP.DiscouragedFunctions.Discouraged -- Scoped to this call and restored below; keeps the token out of exception traces.
+		$previous = ini_set( 'zend.exception_ignore_args', '1' ); // phpcs:ignore Squiz.PHP.DiscouragedFunctions.Discouraged, WordPress.PHP.IniSet.Risky -- Scoped to this call and restored below; keeps the token out of exception traces.
 		try {
 			return $work();
 		} finally {
 			if ( false !== $previous ) {
-				ini_set( 'zend.exception_ignore_args', $previous ); // phpcs:ignore Squiz.PHP.DiscouragedFunctions.Discouraged -- Restores the value saved above.
+				ini_set( 'zend.exception_ignore_args', $previous ); // phpcs:ignore Squiz.PHP.DiscouragedFunctions.Discouraged, WordPress.PHP.IniSet.Risky -- Restores the value saved above.
 			}
 		}
 	}
@@ -141,7 +141,7 @@ private static function begin( $id, $token, $repository, $on_conflict, $base_bra
 			$previous = array();
 			if ( isset( $remote['bridge/manifest.json'] ) ) {
 				$blob = self::request( $token, 'GET', $prefix . '/git/blobs/' . $remote['bridge/manifest.json'] );
-				$manifest = json_decode( base64_decode( str_replace( "\n", '', $blob['content'] ), true ), true );
+				$manifest = json_decode( base64_decode( str_replace( "\n", '', $blob['content'] ), true ), true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode -- The GitHub blob API returns file content base64-encoded.
 				if ( ! is_array( $manifest ) || 'contentrain-bridge@1' !== ( $manifest['format'] ?? '' ) || $manifest['site'] !== $job['inventory']['site'] ) {
 					throw new \RuntimeException( 'Existing Bridge content belongs to another source or has an invalid manifest.' );
 				}
@@ -152,7 +152,7 @@ private static function begin( $id, $token, $repository, $on_conflict, $base_bra
 			// the previous manifest's hash is what says nobody edited it since.
 			if ( isset( $remote['bridge/inventory.json'], $job['files']['bridge/inventory.json'] ) ) {
 				$blob = self::request( $token, 'GET', $prefix . '/git/blobs/' . $remote['bridge/inventory.json'] );
-				$raw = (string) base64_decode( str_replace( "\n", '', $blob['content'] ), true );
+				$raw = (string) base64_decode( str_replace( "\n", '', $blob['content'] ), true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode -- The GitHub blob API returns file content base64-encoded.
 				$trusted = $previous['bridge/inventory.json']['sha256'] ?? null;
 				$after = json_decode( Files::read( Files::dir( $job['id'] ) . '/output', 'bridge/inventory.json' ), true );
 				// Edited in Git after delivery: not a cursor this export can trust.
@@ -181,7 +181,7 @@ private static function removable( $plan, $token, $prefix, $remote ) {
 				return array();
 			}
 			$blob = self::request( $token, 'GET', $prefix . '/git/blobs/' . $remote[ $path ] );
-			$data = json_decode( (string) base64_decode( str_replace( "\n", '', $blob['content'] ), true ), true );
+			$data = json_decode( (string) base64_decode( str_replace( "\n", '', $blob['content'] ), true ), true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode -- The GitHub blob API returns file content base64-encoded.
 			return is_array( $data ) ? $data : array();
 		};
 		$entries = null;
@@ -263,7 +263,7 @@ private static function advance( $id, $token, $expected ) {
 				$git_sha = sha1( 'blob ' . strlen( $content ) . "\0" . $content );
 				if ( isset( $g['remote'][ $path ] ) && $g['remote'][ $path ] !== $git_sha ) {
 					$old = self::request( $token, 'GET', $prefix . '/git/blobs/' . $g['remote'][ $path ] );
-					$old_content = base64_decode( str_replace( "\n", '', $old['content'] ), true );
+					$old_content = base64_decode( str_replace( "\n", '', $old['content'] ), true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode -- The GitHub blob API returns file content base64-encoded.
 					$trusted = $g['previous'][ $path ]['sha256'] ?? null;
 					// The manifest identifies the previous snapshot; it is the only self-describing file.
 					if ( 'bridge/manifest.json' !== $path && ( ! $trusted || hash( 'sha256', $old_content ) !== $trusted ) ) {
@@ -280,7 +280,7 @@ private static function advance( $id, $token, $expected ) {
 						}
 					}
 				}
-				$blob = self::request( $token, 'POST', $prefix . '/git/blobs', array( 'content' => base64_encode( $content ), 'encoding' => 'base64' ) );
+				$blob = self::request( $token, 'POST', $prefix . '/git/blobs', array( 'content' => base64_encode( $content ), 'encoding' => 'base64' ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode -- The GitHub blob API takes file content base64-encoded.
 				$g['nodes'][] = array( 'path' => $path, 'mode' => '100644', 'type' => 'blob', 'sha' => $blob['sha'] );
 				++$g['cursor'];
 			} elseif ( 'files' === $g['phase'] ) {
diff --git a/includes/class-contentrain-bridge-inventory.php b/includes/class-contentrain-bridge-inventory.php
index 32303f5..8065dd8 100644
--- a/includes/class-contentrain-bridge-inventory.php
+++ b/includes/class-contentrain-bridge-inventory.php
@@ -183,13 +183,19 @@ public static function write( &$job, $journal, $path ) {
 		$index = array();
 		$in = file_exists( $journal ) ? fopen( $journal, 'rb' ) : null; // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fopen -- Streamed read of a large journal.
 		if ( $in ) {
-			for ( $offset = ftell( $in ); false !== ( $line = fgets( $in ) ); $offset = ftell( $in ) ) {
+			$offset = ftell( $in );
+			while ( true ) {
+				$line = fgets( $in );
+				if ( false === $line ) {
+					break;
+				}
 				if ( preg_match( '/^\{"wp_type":"((?:[^"\\\\]|\\\\.)*)","wp_id":(\d+)/', $line, $m ) ) {
 					$index[] = stripcslashes( $m[1] ) . "\0" . str_pad( $m[2], 20, '0', STR_PAD_LEFT ) . "\0" . $offset;
 				} else {
 					$record = json_decode( $line, true );
 					$index[] = $record['wp_type'] . "\0" . str_pad( (string) (int) $record['wp_id'], 20, '0', STR_PAD_LEFT ) . "\0" . $offset;
 				}
+				$offset = ftell( $in );
 			}
 		}
 		// (wp_type, wp_id): the type by strcmp, then the zero-padded id; exactly `compare()`.
@@ -285,7 +291,7 @@ private static function post_record( $post, $scope ) {
 		} else {
 			$excluded = array();
 			$mapped = Source::post( $post, $scope['selected_meta'], $excluded )['raw'];
-			$path = wp_make_link_relative( get_permalink( $post ) );
+			$path = wp_make_link_relative( Source::permalink( $post ) );
 		}
 		$record = array(
 			'wp_type' => $post->post_type,
@@ -309,7 +315,7 @@ private static function post_record( $post, $scope ) {
 			if ( $modified && 'nav_menu_item' !== $post->post_type ) {
 				$record['modified_at'] = gmdate( 'Y-m-d\TH:i:s\Z', strtotime( $modified ) );
 			}
-			$old = array_values( array_unique( array_map( 'strval', (array) get_post_meta( $post->ID, '_wp_old_slug' ) ) ) );
+			$old = array_values( array_unique( array_map( 'strval', (array) get_post_meta( $post->ID, '_wp_old_slug', false ) ) ) );
 			if ( $old ) {
 				sort( $old, SORT_STRING );
 				$record['old_slugs'] = $old;
diff --git a/includes/class-contentrain-bridge-jobs.php b/includes/class-contentrain-bridge-jobs.php
index 775b47a..e7877c4 100644
--- a/includes/class-contentrain-bridge-jobs.php
+++ b/includes/class-contentrain-bridge-jobs.php
@@ -5,13 +5,27 @@
 defined( 'ABSPATH' ) || exit;
 
 final class Jobs {
+	/**
+	 * Who an export belongs to, said explicitly: `user` (the administrator's id) and `via` — `admin` (the Bridge
+	 * screen), `app_password` (REST, signed in) or `key` (REST with the connection key, which signs nobody in:
+	 * the user is the key's creator, read from the key's record, never from `get_current_user_id()`).
+	 */
+	public static function principal( $remote = false ) {
+		if ( Key::active() ) {
+			return array( 'user' => Key::owner(), 'via' => 'key', 'key' => Key::hash() );
+		}
+		return array( 'user' => get_current_user_id(), 'via' => $remote ? 'app_password' : 'admin' );
+	}
+
 	/**
 	 * `$remote`: started over REST (`Remote`), listed there rather than as the
 	 * admin screen's one export, and never waiting on a person: no source scan,
-	 * so no text candidates to review.
+	 * so no text candidates to review. `$principal`: whose export it is
+	 * (`principal()`); the state records it as `owner` and `via`.
 	 */
-	public static function create( $input, $remote = false ) {
+	public static function create( $input, $remote = false, $principal = null ) {
 		Files::cleanup();
+		$principal = is_array( $principal ) ? $principal : self::principal( $remote );
 		if ( $remote ) {
 			$input = array_merge( $input, array( 'scan_plugins' => false, 'scan_sources' => false, 'scan_render' => false, 'selected_meta' => array(), 'labels' => array() ) );
 		}
@@ -20,7 +34,7 @@ public static function create( $input, $remote = false ) {
 		if ( ! $types ) {
 			throw new \RuntimeException( 'Select at least one content type.' );
 		}
-		$old = $remote ? null : get_user_meta( get_current_user_id(), 'contentrain_bridge_job_' . get_current_blog_id(), true );
+		$old = 'admin' === $principal['via'] ? get_user_meta( get_current_user_id(), 'contentrain_bridge_job_' . get_current_blog_id(), true ) : null;
 		if ( $old && is_dir( Files::dir( $old ) ) ) {
 			throw new \RuntimeException( 'Resume or delete your previous export before starting another.' );
 		}
@@ -34,7 +48,7 @@ public static function create( $input, $remote = false ) {
 		// taken here because it selects the paths every later step writes to.
 		$languages = array_values( array_unique( array_map( array( Source::class, 'locale' ), (array) $inventory['languages'] ) ) );
 		$job = array(
-			'id' => $id, 'remote' => (bool) $remote, 'owner' => get_current_user_id(), 'blog' => get_current_blog_id(), 'created_at' => gmdate( 'c' ),
+			'id' => $id, 'remote' => (bool) $remote, 'owner' => (int) $principal['user'], 'via' => $principal['via'], 'key' => $principal['key'] ?? null, 'blog' => get_current_blog_id(), 'created_at' => gmdate( 'c' ),
 			'revision' => Source::revision(), 'phase' => 'media', 'cursor' => 0, 'step' => 0,
 			'inventory' => $inventory, 'default_locale' => $locale, 'locales' => array( $locale => true ), 'i18n' => count( $languages ) > 1,
 			'options' => array( 'types' => $types, 'private' => ! empty( $input['private'] ), 'comments' => ! empty( $input['comments'] ), 'media_files' => ! array_key_exists( 'media_files', $input ) || ! empty( $input['media_files'] ), 'scan_plugins' => ! empty( $input['scan_plugins'] ), 'scan_sources' => ! empty( $input['scan_sources'] ), 'scan_render' => ! empty( $input['scan_render'] ), 'selected_meta' => array_values( array_filter( array_map( 'sanitize_text_field', (array) ( $input['selected_meta'] ?? array() ) ) ) ), 'labels' => array_map( 'sanitize_text_field', (array) ( $input['labels'] ?? array() ) ) ),
@@ -70,15 +84,31 @@ public static function create( $input, $remote = false ) {
 		}
 		self::warning( $job, array( 'source' => 'rendered-states', 'reason' => 'Source scan does not execute dynamic WordPress/plugin states. Rendered coverage requires the Migrate capture adapter.' ) );
 		self::save( $job );
-		if ( ! $remote ) {
+		if ( 'admin' === $principal['via'] ) {
 			update_user_meta( get_current_user_id(), 'contentrain_bridge_job_' . get_current_blog_id(), $id );
 		}
 		return self::summary( $job );
 	}
 
+	/**
+	 * Whether the caller may read this export. A key reads the exports it started (`via` key, listed in `Key::exports()`)
+	 * and nothing else; a signed-in administrator reads their own screen and application-password exports and never a
+	 * key's. Neither side's rule touches the other's identity: with a key there is no current user to compare.
+	 */
+	public static function owned( $job ) {
+		if ( ! is_array( $job ) || ! isset( $job['owner'], $job['blog'] ) || (int) $job['blog'] !== get_current_blog_id() ) {
+			return false;
+		}
+		$via = isset( $job['via'] ) ? (string) $job['via'] : '';
+		if ( Key::active() ) {
+			return 'key' === $via && ( $job['key'] ?? '' ) === Key::hash() && in_array( $job['id'] ?? '', Key::exports(), true );
+		}
+		return 'key' !== $via && get_current_user_id() > 0 && (int) $job['owner'] === get_current_user_id();
+	}
+
 	public static function read( $id ) {
 		$job = json_decode( Files::read( Files::dir( $id ), 'state.json' ), true );
-		if ( ! is_array( $job ) || (int) $job['owner'] !== get_current_user_id() || (int) $job['blog'] !== get_current_blog_id() ) {
+		if ( ! self::owned( $job ) ) {
 			throw new \RuntimeException( 'Export is not owned by the current user.' );
 		}
 		if ( strtotime( $job['created_at'] ) < time() - DAY_IN_SECONDS ) {
@@ -228,7 +258,7 @@ public static function time_limit() {
 		if ( $max <= 0 ) {
 			return INF;
 		}
-		$start = isset( $_SERVER['REQUEST_TIME_FLOAT'] ) ? (float) $_SERVER['REQUEST_TIME_FLOAT'] : microtime( true );
+		$start = isset( $_SERVER['REQUEST_TIME_FLOAT'] ) ? (float) sanitize_text_field( wp_unslash( $_SERVER['REQUEST_TIME_FLOAT'] ) ) : microtime( true );
 		return $start + $max - 5;
 	}
 
@@ -757,7 +787,10 @@ private static function sources( &$job ) {
 			return;
 		}
 		$files = $job['source_files'];
-		$states = $job['options']['scan_render'] ? ( $job['render_states'] = $job['render_states'] ?? Text::render_states() ) : array();
+		if ( $job['options']['scan_render'] && ! isset( $job['render_states'] ) ) {
+			$job['render_states'] = Text::render_states();
+		}
+		$states = $job['options']['scan_render'] ? $job['render_states'] : array();
 		$step = $job['cursor'];
 		self::progress( $job, count( $files ) + 1 + count( $states ) );
 		$job['text'] = $job['text'] ?? array( 'occurrences' => array(), 'errors' => array(), 'counts' => array( 'unlisted_excluded' => 0, 'unlisted_by_reason' => array(), 'sources' => array( 'files' => count( $files ), 'settings' => 1, 'render_states' => count( $states ) ) ) );
diff --git a/includes/class-contentrain-bridge-key.php b/includes/class-contentrain-bridge-key.php
index 6924c6b..8a53554 100644
--- a/includes/class-contentrain-bridge-key.php
+++ b/includes/class-contentrain-bridge-key.php
@@ -14,15 +14,19 @@
  *   from the query string: an address ends up in access logs and caches.
  * - Only its SHA-256 is stored; the key is shown once. One key at a time: a new
  *   one retires the previous one.
- * - It opens the `contentrain-bridge/v1` routes only, acting as the administrator
- *   who created it, and only while that user still has `export` + `manage_options`.
- *   WordPress's own REST API is not opened by it.
+ * - It opens the `contentrain-bridge/v1` routes only, and runs with no WordPress
+ *   user: the request is never signed in as anyone (`get_current_user_id()` stays
+ *   0), so no capability check anywhere passes on its account. It is valid only
+ *   while the administrator who created it still has `export` + `manage_options`,
+ *   checked with `user_can()` on their id. WordPress's own REST API is not opened by it.
  * - Unpaired, it lives an hour: the time to paste it into Migrate. The first
  *   request that carries a `contentrain_pairing` (Migrate's order id) pairs it;
  *   paired, it works for that order until 14 days after it was created, with no
  *   idle limit (reruns can be days apart), until it is revoked or replaced —
  *   by the administrator, or by Migrate itself (`DELETE /key`) when the order closes.
- * - It reads only the exports it started, one running at a time.
+ * - It reads only the exports it started, one running at a time. Those exports are
+ *   indexed in the plugin's own option (`EXPORTS`), never in any user's meta, and
+ *   their state names the key as `via`.
  * - A wrong key counts against its address: after ten in 15 minutes, wrong keys
  *   from there are answered 429. The right key is always compared first, so a
  *   shared address (a proxy, a CDN) cannot lock Migrate out.
@@ -43,9 +47,22 @@ final class Key {
 	const RETIRED = 5;
 	const KEPT_EXPORTS = 20;
 
+	/** The format of a key as `create()` returns it: 32 random bytes, base64url, no padding. */
+	const FORMAT = '/^[A-Za-z0-9_-]{43}$/D';
+
 	/** Whether this request authenticated with the key: the remote routes then show only the key's own exports. */
 	private static $active = false;
 
+	/** Clear the key after every REST callback: one PHP process can serve several requests, and nothing may leak into the next. */
+	public static function register() {
+		add_filter( 'rest_request_after_callbacks', array( self::class, 'after_callbacks' ), 1000 );
+	}
+
+	public static function after_callbacks( $response ) {
+		self::clear();
+		return $response;
+	}
+
 	public static function secure() {
 		return (bool) apply_filters( 'contentrain_bridge_key_secure', is_ssl() || 'local' === wp_get_environment_type() );
 	}
@@ -59,7 +76,7 @@ public static function clear() {
 		self::$active = false;
 	}
 
-	/** A new key for the current administrator; the previous one stops working. Returned once, never stored. */
+	/** A new key for the current administrator; the previous one stops working and its exports are removed. Returned once, never stored. */
 	public static function create() {
 		if ( ! Admin::permitted() ) {
 			throw new \RuntimeException( 'Export and administrator permissions are required.' );
@@ -67,7 +84,10 @@ public static function create() {
 		if ( ! self::secure() ) {
 			throw new \RuntimeException( 'Use HTTPS on this site before creating a connection key.' );
 		}
-		$key = rtrim( strtr( base64_encode( random_bytes( 32 ) ), '+/', '-_' ), '=' );
+		foreach ( self::exports() as $id ) {
+			self::remove_export( $id );
+		}
+		$key = rtrim( strtr( base64_encode( random_bytes( 32 ) ), '+/', '-_' ), '=' ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode -- Random bytes as base64url text: the key itself, nothing encoded to hide.
 		update_option( self::OPTION, array(
 			'hash' => hash( 'sha256', $key ),
 			'user' => get_current_user_id(),
@@ -80,16 +100,43 @@ public static function create() {
 		return $key;
 	}
 
-	/** Stop the current key — the administrator on the Bridge screen, or Migrate with the key itself. A retired key is answered as revoked, not as unknown. */
+	/**
+	 * Stop the current key — the administrator on the Bridge screen, or Migrate with the key itself (the request
+	 * then carries no user, so the key's own authorization stands in for the screen's permission). A retired key is
+	 * answered as revoked, not as unknown. The key's exports go with it: nothing else can read them once it is gone.
+	 */
 	public static function revoke() {
-		if ( ! Admin::permitted() ) {
+		if ( ! self::$active && ! Admin::permitted() ) {
 			throw new \RuntimeException( 'Export and administrator permissions are required.' );
 		}
+		foreach ( self::exports() as $id ) {
+			self::remove_export( $id );
+		}
 		update_option( self::OPTION, array( 'retired' => self::retired() ), false );
 		delete_option( self::SEEN );
 		delete_option( self::EXPORTS );
 	}
 
+	/** Remove one of the key's export directories unless a request holds it; a held one expires with `Files::cleanup()`. */
+	private static function remove_export( $id ) {
+		try {
+			$dir = Files::dir( $id );
+		} catch ( \RuntimeException $invalid ) {
+			return;
+		}
+		if ( ! is_dir( $dir ) ) {
+			return;
+		}
+		$lock = fopen( $dir . '/lock', 'c' ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fopen -- Native advisory lock; filesystem API has no locking primitive.
+		if ( $lock && flock( $lock, LOCK_EX | LOCK_NB ) ) {
+			Files::remove( $dir );
+			flock( $lock, LOCK_UN );
+		}
+		if ( $lock ) {
+			fclose( $lock ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- Native advisory lock handle.
+		}
+	}
+
 	/** What the Bridge screen shows about the current key; never the key or its hash. */
 	public static function status() {
 		$record = self::record();
@@ -130,12 +177,20 @@ public static function presented( $request ) {
 		return null !== $header ? $header : $field;
 	}
 
-	/** Accept the key for this request, as its administrator, or say why not. */
+	/**
+	 * Accept the key for this request, or say why not. Nothing here signs anyone in: the request keeps user 0 for its
+	 * whole life, and the export code receives the key's owner explicitly (`Jobs::principal()`). The creator's
+	 * continued `export` + `manage_options` is a validity condition of the key, read with `user_can()` on their id.
+	 */
 	public static function authorize( $request, $key ) {
 		if ( ! self::secure() ) {
 			return self::error( 'insecure', 'This site is not served over HTTPS, so a connection key cannot be used.', 403 );
 		}
 		$ip = self::ip();
+		// A string that cannot be a key is refused before anything is hashed or compared; it counts as a wrong key.
+		if ( ! is_string( $key ) || ! preg_match( self::FORMAT, $key ) ) {
+			return self::wrong( $ip );
+		}
 		$hash = hash( 'sha256', $key );
 		$record = self::record();
 		// The key is compared before the address is held back: behind a shared address (a proxy, a CDN)
@@ -144,30 +199,22 @@ public static function authorize( $request, $key ) {
 			if ( isset( self::retired()[ $hash ] ) ) {
 				return self::error( 'revoked', 'This connection key was revoked or replaced in WordPress. Create a new one on the Contentrain Bridge screen.', 401 );
 			}
-			$failures = (int) get_transient( self::failures( $ip ) );
-			if ( $failures >= self::FAILURES ) {
-				return self::error( 'rate_limited', 'Too many wrong connection keys from this address; wait 15 minutes.', 429, array( 'retry_after' => self::WINDOW ) );
-			}
-			set_transient( self::failures( $ip ), $failures + 1, self::WINDOW );
-			return self::error( 'invalid', 'The connection key is not valid. Copy it again from the Contentrain Bridge screen.', 401 );
+			return self::wrong( $ip );
 		}
 		if ( time() > self::ends( $record ) ) {
 			return null === $record['pairing']
 				? self::error( 'expired', 'The connection key was not used within an hour of being created. Create a new one on the Contentrain Bridge screen.', 401 )
 				: self::error( 'expired', 'The connection key is 14 days old. Create a new one on the Contentrain Bridge screen.', 401 );
 		}
-		wp_set_current_user( (int) $record['user'] );
-		if ( ! Admin::permitted() ) {
-			wp_set_current_user( 0 );
+		$user = (int) $record['user'];
+		if ( ! user_can( $user, 'export' ) || ! user_can( $user, 'manage_options' ) ) {
 			return self::error( 'forbidden', 'The administrator who created the connection key can no longer export this site.', 403 );
 		}
 		$pairing = $request->get_param( self::PAIRING );
 		if ( ! is_string( $pairing ) || ! preg_match( '/^[A-Za-z0-9_-]{8,64}$/D', $pairing ) ) {
-			wp_set_current_user( 0 );
 			return self::error( 'pairing_required', 'contentrain_pairing (8 to 64 letters, digits, - or _) is required with a connection key.', 400 );
 		}
 		if ( null !== $record['pairing'] && ! hash_equals( $record['pairing'], $pairing ) ) {
-			wp_set_current_user( 0 );
 			return self::error( 'paired_elsewhere', 'This connection key belongs to another Migrate order. Create a new one for this order.', 403 );
 		}
 		// Paired by the first accepted request of any route — Migrate's access check included, which reads an
@@ -180,13 +227,34 @@ public static function authorize( $request, $key ) {
 		// The export in the route itself, never a body or query field of the same name.
 		$id = $request->get_url_params()['id'] ?? null;
 		if ( null !== $id && ! in_array( $id, self::exports(), true ) ) {
-			wp_set_current_user( 0 );
 			return new \WP_Error( 'bridge_not_found', 'No such export for this connection key.', array( 'status' => 404 ) );
 		}
 		self::$active = true;
 		return true;
 	}
 
+	/** A wrong key from `$ip`: counted, and 429 once the address has had its ten in the window. */
+	private static function wrong( $ip ) {
+		$failures = (int) get_transient( self::failures( $ip ) );
+		if ( $failures >= self::FAILURES ) {
+			return self::error( 'rate_limited', 'Too many wrong connection keys from this address; wait 15 minutes.', 429, array( 'retry_after' => self::WINDOW ) );
+		}
+		set_transient( self::failures( $ip ), $failures + 1, self::WINDOW );
+		return self::error( 'invalid', 'The connection key is not valid. Copy it again from the Contentrain Bridge screen.', 401 );
+	}
+
+	/** The administrator who created the active key: the owner every export it starts is recorded under. */
+	public static function owner() {
+		$record = self::record();
+		return $record ? (int) $record['user'] : 0;
+	}
+
+	/** The SHA-256 of the active key, as the option stores it: what a key export's state names. */
+	public static function hash() {
+		$record = self::record();
+		return $record ? (string) $record['hash'] : '';
+	}
+
 	/** DELETE /key: Migrate closes its own key when the order is done. Only the key itself can ask. */
 	public static function permitted_self( $request ) {
 		self::clear();
@@ -211,11 +279,9 @@ public static function exports() {
 		return is_array( $ids ) ? array_values( array_filter( $ids, static function ( $id ) { return is_string( $id ) && preg_match( '/^[a-f0-9]{32}$/D', $id ); } ) ) : array();
 	}
 
-	/** Record an export as this key's; called under the remote start lock. */
-	public static function bind( $id ) {
-		$ids = array_values( array_diff( self::exports(), array( $id ) ) );
-		$ids[] = $id;
-		update_option( self::EXPORTS, array_slice( $ids, -self::KEPT_EXPORTS ), false );
+	/** The key's export list, newest last, at most KEPT_EXPORTS. */
+	public static function set( $ids ) {
+		update_option( self::EXPORTS, array_slice( array_values( $ids ), -self::KEPT_EXPORTS ), false );
 	}
 
 	private static function record() {
diff --git a/includes/class-contentrain-bridge-menus.php b/includes/class-contentrain-bridge-menus.php
index 8990ac1..f76f85b 100644
--- a/includes/class-contentrain-bridge-menus.php
+++ b/includes/class-contentrain-bridge-menus.php
@@ -328,7 +328,7 @@ private static function public_pages() {
 		$out = array();
 		foreach ( get_pages( array( 'post_status' => 'publish' ) ) as $page ) {
 			if ( ! $page->post_password ) {
-				$out[] = array( 'id' => (int) $page->ID, 'parent' => (int) $page->post_parent, 'menu_order' => (int) $page->menu_order, 'title' => $page->post_title, 'slug' => $page->post_name, 'link' => (string) get_permalink( $page ) );
+				$out[] = array( 'id' => (int) $page->ID, 'parent' => (int) $page->post_parent, 'menu_order' => (int) $page->menu_order, 'title' => $page->post_title, 'slug' => $page->post_name, 'link' => Source::permalink( $page ) );
 			}
 		}
 		return $out;
diff --git a/includes/class-contentrain-bridge-models.php b/includes/class-contentrain-bridge-models.php
index 7edb6b4..688d73d 100644
--- a/includes/class-contentrain-bridge-models.php
+++ b/includes/class-contentrain-bridge-models.php
@@ -90,7 +90,7 @@ public static function model( &$job, $id, $kind, $domain, $name, $fields, $title
 		$existing = $job['models'][ $id ] ?? null;
 		if ( $existing ) {
 			foreach ( $fields as $key => $definition ) {
-				if ( isset( $existing['fields'][ $key ] ) && $existing['fields'][ $key ] != $definition ) {
+				if ( isset( $existing['fields'][ $key ] ) && $existing['fields'][ $key ] != $definition ) { // phpcs:ignore Universal.Operators.StrictComparisons.LooseNotEqual -- Field definitions are arrays compared by value, key order aside.
 					throw new \RuntimeException( 'Inconsistent field types in ' . $id . '.' . $key . '; choose a consistent model before exporting.' ); // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- Diagnostic data is escaped at the admin output boundary or JSON encoded.
 				}
 			}
diff --git a/includes/class-contentrain-bridge-redirects.php b/includes/class-contentrain-bridge-redirects.php
index 8174814..1d2425b 100644
--- a/includes/class-contentrain-bridge-redirects.php
+++ b/includes/class-contentrain-bridge-redirects.php
@@ -199,10 +199,10 @@ private static function simple_301( &$doc ) {
 		$i = 0;
 		foreach ( $rules as $from => $to ) {
 			$from = (string) $from;
-			$rule = array( 'id' => 'simple_301_redirects:' . $i++, 'from' => $from, 'source' => 'simple_301_redirects', 'match' => 'url', 'regex' => false );
+			$rule = array( 'id' => 'simple_301_redirects:' . ( $i++ ), 'from' => $from, 'source' => 'simple_301_redirects', 'match' => 'url', 'regex' => false );
 			if ( $wildcard && false !== strpos( $from, '*' ) ) {
 				// preg_quote() escapes `-` and `#` too, which a JavaScript `u` regex rejects outside a class.
-				$rule['from'] = '^' . str_replace( array( '\*', '\-', '\#' ), array( '(.*)', '-', '#' ), preg_quote( $from ) ) . '$';
+				$rule['from'] = '^' . str_replace( array( '\*', '\-', '\#' ), array( '(.*)', '-', '#' ), preg_quote( $from ) ) . '$'; // phpcs:ignore WordPress.PHP.PregQuoteDelimiter.Missing -- Exported for a JavaScript RegExp, never used with a PHP delimiter; a quoted slash would not match.
 				$rule['match'] = 'regex';
 				$rule['regex'] = true;
 				$to = str_replace( '*', '$1', (string) $to );
@@ -232,14 +232,16 @@ private static function htaccess( &$doc ) {
 			$doc['sources']['htaccess'] = array( 'status' => 'unreadable' );
 			return;
 		}
-		$software = (string) ( $_SERVER['SERVER_SOFTWARE'] ?? '' ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput -- Compared, never output.
+		$software = isset( $_SERVER['SERVER_SOFTWARE'] ) ? sanitize_text_field( wp_unslash( $_SERVER['SERVER_SOFTWARE'] ) ) : '';
 		// Unknown (a CLI run) is read as Apache: the file exists because the site's server uses it.
 		$apache = '' === $software || false !== stripos( $software, 'apache' ) || false !== stripos( $software, 'litespeed' );
 		self::$serving = $apache;
 		$count = self::htaccess_rules( $doc, $lines );
 		$doc['sources']['htaccess'] = self::source( $apache ? 'active' : 'inactive-with-data', $count );
 		if ( ! $apache ) {
-			$doc['sources']['htaccess']['note'] = 'server ' . $software . ' does not read .htaccess';
+			// The note names a class of server, never the header's own text: this document is exported.
+			$kind = false !== stripos( $software, 'nginx' ) ? 'nginx' : ( false !== stripos( $software, 'iis' ) ? 'iis' : 'other' );
+			$doc['sources']['htaccess']['note'] = $kind . ' does not read .htaccess';
 		}
 		if ( untrailingslashit( (string) wp_parse_url( home_url( '/' ), PHP_URL_PATH ) ) !== untrailingslashit( (string) wp_parse_url( site_url( '/' ), PHP_URL_PATH ) ) ) {
 			$doc['sources']['htaccess']['note'] = 'WordPress is in a subdirectory: the .htaccess that serves the home address is not the one read';
@@ -458,7 +460,7 @@ private static function old_slugs( &$doc ) {
 		foreach ( $rows as $row ) {
 			$post = get_post( (int) $row['post_id'] );
 			$rule = array( 'id' => 'wordpress:old-slug:' . $row['post_id'] . ':' . $row['meta_value'], 'source' => 'wordpress', 'match' => 'url', 'regex' => false );
-			$current = $post ? get_permalink( $post ) : false;
+			$current = $post ? Source::permalink( $post ) : false;
 			if ( ! $current || ! is_post_type_viewable( $post->post_type ) || ! get_option( 'permalink_structure' ) ) {
 				// With plain permalinks the address is `?p=ID`: the slug was never in it.
 				$rule['from'] = (string) $row['meta_value'];
@@ -467,7 +469,7 @@ private static function old_slugs( &$doc ) {
 			}
 			$old = clone $post;
 			$old->post_name = (string) $row['meta_value'];
-			$rule['from'] = wp_make_link_relative( get_permalink( $old ) );
+			$rule['from'] = wp_make_link_relative( Source::permalink( $old ) );
 			if ( $post->post_name === $old->post_name ) {
 				self::exclude( $doc, $rule, 'slug-reused' );
 				continue;
diff --git a/includes/class-contentrain-bridge-remote.php b/includes/class-contentrain-bridge-remote.php
index 225d087..9c71a1f 100644
--- a/includes/class-contentrain-bridge-remote.php
+++ b/includes/class-contentrain-bridge-remote.php
@@ -9,8 +9,11 @@
  * (BR-19). Same permission as the read API (`export` + `manage_options`), same
  * jobs, same snapshot. The program signs in with an application password, or,
  * where the host strips the Authorization header, with the connection key an
- * administrator created on the Bridge screen (`Key`, BR-27): the key's exports
- * only, one running at a time.
+ * administrator created on the Bridge screen (`Key`, BR-27). A keyed request
+ * runs with no WordPress user at all: the key is valid only while its creator
+ * still has `export` + `manage_options`, its exports are listed in the plugin's
+ * own option rather than in anyone's user meta, and it sees those exports only,
+ * one running at a time.
  *
  *   GET  /contentrain-bridge/v1/about                  → { version, auth: [ "app_password", "key" ] }, no sign-in
  *
@@ -54,17 +57,72 @@ final class Remote {
 	const READ_GUARD = 600;
 
 	public static function routes() {
+		$permitted = array( self::class, 'permitted' );
 		// Public by design: what a reader needs to choose how to sign in. No site data.
 		register_rest_route( 'contentrain-bridge/v1', '/about', array( 'methods' => 'GET', 'permission_callback' => '__return_true', 'callback' => array( self::class, 'about' ) ) );
 		// Published counts for a price before payment (Migrate gate item 10): the same reader permission as an export, never public.
-		register_rest_route( 'contentrain-bridge/v1', '/counts', array( 'methods' => 'GET', 'permission_callback' => array( self::class, 'permitted' ), 'callback' => array( self::class, 'counts' ) ) );
+		register_rest_route( 'contentrain-bridge/v1', '/counts', array( 'methods' => 'GET', 'permission_callback' => $permitted, 'callback' => array( self::class, 'counts' ), 'args' => self::key_args() ) );
 		register_rest_route( 'contentrain-bridge/v1', '/exports', array(
-			array( 'methods' => 'POST', 'permission_callback' => array( self::class, 'permitted' ), 'callback' => array( self::class, 'start' ) ),
-			array( 'methods' => 'GET', 'permission_callback' => array( self::class, 'permitted' ), 'callback' => array( self::class, 'index' ) ),
+			array( 'methods' => 'POST', 'permission_callback' => $permitted, 'callback' => array( self::class, 'start' ), 'args' => self::start_args() ),
+			array( 'methods' => 'GET', 'permission_callback' => $permitted, 'callback' => array( self::class, 'index' ), 'args' => self::key_args() ),
 		) );
 		// Migrate closes its own key when the order is done (BR-27).
-		register_rest_route( 'contentrain-bridge/v1', '/key', array( 'methods' => 'DELETE', 'permission_callback' => array( Key::class, 'permitted_self' ), 'callback' => array( Key::class, 'revoke_self' ) ) );
-		register_rest_route( 'contentrain-bridge/v1', '/exports/(?P<id>[a-f0-9]{32})/advance', array( 'methods' => 'POST', 'permission_callback' => array( self::class, 'permitted' ), 'callback' => array( self::class, 'advance' ) ) );
+		register_rest_route( 'contentrain-bridge/v1', '/key', array( 'methods' => 'DELETE', 'permission_callback' => array( Key::class, 'permitted_self' ), 'callback' => array( Key::class, 'revoke_self' ), 'args' => self::key_args() ) );
+		register_rest_route( 'contentrain-bridge/v1', '/exports/(?P<id>[a-f0-9]{32})/advance', array( 'methods' => 'POST', 'permission_callback' => $permitted, 'callback' => array( self::class, 'advance' ), 'args' => self::key_args() ) );
+	}
+
+	/**
+	 * The two fields a keyed call carries in its body or query. WordPress validates and sanitizes declared
+	 * arguments before it runs the permission callback, so a malformed body field is refused with core's own
+	 * `rest_invalid_param` before `Key` reads it; a key sent as a header is not an argument and is checked by
+	 * `Key::authorize()` alone. These declare the fields for the schema; they do not replace `Key::authorize()`.
+	 */
+	public static function key_args() {
+		return array(
+			Key::PAIRING => array( 'type' => 'string', 'sanitize_callback' => 'sanitize_text_field', 'validate_callback' => array( self::class, 'validate_pairing' ) ),
+			Key::FIELD => array( 'type' => 'string', 'sanitize_callback' => 'sanitize_text_field', 'validate_callback' => array( self::class, 'validate_key' ) ),
+		);
+	}
+
+	/** `POST /exports`: the scope and the reuse window. The inline checks in `start()` stay; these bound each value first. */
+	public static function start_args() {
+		$flag = array( 'type' => 'boolean', 'sanitize_callback' => 'rest_sanitize_boolean', 'validate_callback' => 'rest_is_boolean' );
+		return array(
+			'types' => array( 'type' => 'array', 'items' => array( 'type' => 'string' ), 'sanitize_callback' => array( self::class, 'sanitize_types' ), 'validate_callback' => array( self::class, 'validate_types' ) ),
+			'private' => $flag,
+			'comments' => $flag,
+			'media_files' => $flag,
+			'fresh' => $flag,
+			'max_age' => array( 'type' => 'integer', 'sanitize_callback' => 'absint', 'validate_callback' => array( self::class, 'validate_max_age' ) ),
+		) + self::key_args();
+	}
+
+	public static function validate_pairing( $value ) {
+		return is_string( $value ) && 1 === preg_match( '/^[A-Za-z0-9_-]{8,64}$/D', $value );
+	}
+
+	public static function validate_key( $value ) {
+		return is_string( $value ) && 1 === preg_match( Key::FORMAT, trim( $value ) );
+	}
+
+	public static function validate_types( $value ) {
+		if ( ! is_array( $value ) || count( $value ) > 200 ) {
+			return false;
+		}
+		foreach ( $value as $type ) {
+			if ( ! is_string( $type ) || 1 !== preg_match( '/^[a-z0-9_-]{1,20}$/D', $type ) ) {
+				return false;
+			}
+		}
+		return true;
+	}
+
+	public static function sanitize_types( $value ) {
+		return array_values( array_map( 'sanitize_key', (array) $value ) );
+	}
+
+	public static function validate_max_age( $value ) {
+		return ( is_int( $value ) && $value >= 0 && $value <= 999999999 ) || ( is_string( $value ) && 1 === preg_match( '/^[0-9]{1,9}$/D', $value ) );
 	}
 
 	/** The read API's permission, or the connection key when the request carries one. */
@@ -160,22 +218,16 @@ public static function start( $request ) {
 					}
 					++$live;
 					if ( $same ) {
-						if ( Key::active() ) {
-							Key::bind( $job['id'] );
-						}
 						return new \WP_REST_Response( array( 'export' => Jobs::summary( $job ), 'reused' => true ), 200, self::headers() );
 					}
 				}
 				if ( $live >= self::LIVE_LIMIT ) {
 					return self::error( 'too_many_exports', 'Three exports are already in progress for this user; let one finish or expire.', 429 );
 				}
-				$summary = Jobs::create( $scope, true );
+				$summary = Jobs::create( $scope, true, Jobs::principal( true ) );
 				$ids = self::ids();
 				$ids[] = $summary['id'];
-				update_user_meta( get_current_user_id(), self::META . get_current_blog_id(), $ids );
-				if ( Key::active() ) {
-					Key::bind( $summary['id'] );
-				}
+				self::remember( $ids );
 				return new \WP_REST_Response( array( 'export' => $summary, 'reused' => false ), 201, self::headers() );
 			} );
 		} catch ( \Throwable $error ) {
@@ -184,13 +236,10 @@ public static function start( $request ) {
 		}
 	}
 
-	/** The caller's remote exports that still exist, oldest first; with a key, the key's own. */
+	/** The caller's remote exports that still exist, oldest first; with a key, the key's own (`ids()`). */
 	public static function index() {
 		try {
 			$jobs = self::jobs();
-			if ( Key::active() ) {
-				$jobs = array_values( array_filter( $jobs, static function ( $job ) { return in_array( $job['id'], Key::exports(), true ); } ) );
-			}
 			return new \WP_REST_Response( array( 'exports' => array_map( array( Jobs::class, 'summary' ), $jobs ) ), 200, self::headers() );
 		} catch ( \Throwable $error ) {
 			// Input is checked above; what is left is the server's fault, not "not ready".
@@ -267,7 +316,7 @@ private static function discard( $id ) {
 			flock( $lock, LOCK_UN );
 			fclose( $lock ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- Native advisory lock handle.
 		}
-		update_user_meta( get_current_user_id(), self::META . get_current_blog_id(), array_values( array_diff( self::ids(), array( $id ) ) ) );
+		self::remember( array_values( array_diff( self::ids(), array( $id ) ) ) );
 		return true;
 	}
 
@@ -290,11 +339,24 @@ private static function code( $message ) {
 		return 'export_failed';
 	}
 
+	/** The caller's export ids: the key's own list (the plugin's option) with a key, the signed-in user's meta otherwise. */
 	private static function ids() {
+		if ( Key::active() ) {
+			return Key::exports();
+		}
 		$ids = get_user_meta( get_current_user_id(), self::META . get_current_blog_id(), true );
 		return is_array( $ids ) ? array_values( array_filter( $ids, static function ( $id ) { return is_string( $id ) && preg_match( '/^[a-f0-9]{32}$/D', $id ); } ) ) : array();
 	}
 
+	/** Store the caller's export ids where `ids()` reads them. */
+	private static function remember( $ids ) {
+		if ( Key::active() ) {
+			Key::set( $ids );
+			return;
+		}
+		update_user_meta( get_current_user_id(), self::META . get_current_blog_id(), $ids );
+	}
+
 	/** Readable jobs only; an expired or deleted one leaves the list. */
 	private static function jobs() {
 		$jobs = array();
@@ -308,14 +370,14 @@ private static function jobs() {
 			}
 		}
 		if ( $kept !== self::ids() ) {
-			update_user_meta( get_current_user_id(), self::META . get_current_blog_id(), $kept );
+			self::remember( $kept );
 		}
 		return $jobs;
 	}
 
-	/** One start at a time per user: two concurrent requests cannot both create. */
+	/** One start at a time per caller (the key, or the signed-in user): two concurrent requests cannot both create. */
 	private static function locked( $callback ) {
-		$lock = fopen( Files::root() . '/remote-' . get_current_user_id() . '.lock', 'c' ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fopen -- Native advisory lock; filesystem API has no locking primitive.
+		$lock = fopen( Files::root() . '/remote-' . ( Key::active() ? 'key' : get_current_user_id() ) . '.lock', 'c' ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fopen -- Native advisory lock; filesystem API has no locking primitive.
 		if ( ! $lock || ! flock( $lock, LOCK_EX ) ) {
 			throw new \RuntimeException( 'Cannot lock export start.' );
 		}
diff --git a/includes/class-contentrain-bridge-robots.php b/includes/class-contentrain-bridge-robots.php
index fb0e87b..ad2c5b8 100644
--- a/includes/class-contentrain-bridge-robots.php
+++ b/includes/class-contentrain-bridge-robots.php
@@ -98,7 +98,7 @@ public static function toggle() {
 	}
 
 	/** `robots_txt`: WordPress's robots.txt with the Migrate group added when the owner turned it on. */
-	public static function filter( $output, $public = true ) {
+	public static function filter( $output, $public = true ) { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.FoundAfterLastUsed -- The robots_txt filter's signature.
 		$output = (string) $output;
 		if ( ! self::chosen() || self::physical() ) {
 			return $output;
diff --git a/includes/class-contentrain-bridge-routing.php b/includes/class-contentrain-bridge-routing.php
index 87f55cf..02bd956 100644
--- a/includes/class-contentrain-bridge-routing.php
+++ b/includes/class-contentrain-bridge-routing.php
@@ -18,7 +18,7 @@ public static function document() {
 		$front = static function ( $option ) {
 			$id = (int) get_option( $option );
 			$post = $id ? get_post( $id ) : null;
-			return $post ? array( 'id' => $id, 'slug' => $post->post_name, 'path' => wp_make_link_relative( get_permalink( $post ) ) ) : null;
+			return $post ? array( 'id' => $id, 'slug' => $post->post_name, 'path' => wp_make_link_relative( Source::permalink( $post ) ) ) : null;
 		};
 		$post_types = array();
 		foreach ( get_post_types( array( 'public' => true ), 'objects' ) as $type ) {
diff --git a/includes/class-contentrain-bridge-seo-render.php b/includes/class-contentrain-bridge-seo-render.php
index 985e67b..3e2a931 100644
--- a/includes/class-contentrain-bridge-seo-render.php
+++ b/includes/class-contentrain-bridge-seo-render.php
@@ -154,7 +154,7 @@ public static function post_values( $post, $sep, $focus = '', $primary = 0 ) {
 			'parent_title'   => $post->post_parent ? get_the_title( $post->post_parent ) : '',
 			'pt_single'      => $type ? $type->labels->singular_name : '',
 			'pt_plural'      => $type ? $type->labels->name : '',
-			'url'            => (string) get_permalink( $post ),
+			'url'            => Source::permalink( $post ),
 		);
 	}
 
diff --git a/includes/class-contentrain-bridge-seo.php b/includes/class-contentrain-bridge-seo.php
index 0d8775a..621b49b 100644
--- a/includes/class-contentrain-bridge-seo.php
+++ b/includes/class-contentrain-bridge-seo.php
@@ -328,7 +328,7 @@ private static function rank_math_post( $post, &$excluded ) {
 				'title'       => array( $stored['title'] ?? '', $titles[ 'pt_' . $type . '_title' ] ?? '', SeoRender::DEFAULTS['rank_math']['post'][0] ),
 				'description' => array( $stored['description'] ?? '', $titles[ 'pt_' . $type . '_description' ] ?? '', SeoRender::DEFAULTS['rank_math']['post'][1] ),
 				'robots'      => self::rank_math_robots( $robots, $titles, 'pt_' . $type ),
-				'canonical'   => '' !== (string) ( $stored['canonical_url'] ?? '' ) ? (string) $stored['canonical_url'] : (string) get_permalink( $post ),
+				'canonical'   => '' !== (string) ( $stored['canonical_url'] ?? '' ) ? (string) $stored['canonical_url'] : Source::permalink( $post ),
 				'og'          => array( $stored['facebook_title'] ?? '', $stored['facebook_description'] ?? '', self::image_of( $stored, 'facebook_image', $post ) ),
 				'twitter'     => array( $stored['twitter_title'] ?? '', $stored['twitter_description'] ?? '', self::image_of( $stored, 'twitter_image', $post ) ),
 				'schema'      => $schema,
@@ -387,7 +387,7 @@ private static function aioseo_post( $post, &$excluded ) {
 				'title'       => array( $row['title'] ?? '', $type['title'] ?? '', SeoRender::DEFAULTS['aioseo']['post'][0] ),
 				'description' => array( $row['description'] ?? '', $type['metaDescription'] ?? '', SeoRender::DEFAULTS['aioseo']['post'][1] ),
 				'robots'      => array_key_exists( 'robots_default', $row ) && empty( $row['robots_default'] ) ? array( ! $noindex, ! $nofollow, 'post' ) : self::aioseo_robots( (array) ( $type['advanced']['robotsMeta'] ?? array() ), (array) ( $appearance['advanced']['globalRobotsMeta'] ?? array() ) ),
-				'canonical'   => '' !== (string) ( $row['canonical_url'] ?? '' ) ? (string) $row['canonical_url'] : (string) get_permalink( $post ),
+				'canonical'   => '' !== (string) ( $row['canonical_url'] ?? '' ) ? (string) $row['canonical_url'] : Source::permalink( $post ),
 				'og'          => array( $row['og_title'] ?? '', $row['og_description'] ?? '', '' !== (string) ( $row['og_image_custom_url'] ?? '' ) ? $row['og_image_custom_url'] : (int) get_post_thumbnail_id( $post ) ),
 				'twitter'     => array( $row['twitter_title'] ?? '', $row['twitter_description'] ?? '', '' !== (string) ( $row['twitter_image_custom_url'] ?? '' ) ? $row['twitter_image_custom_url'] : (int) get_post_thumbnail_id( $post ) ),
 			),
@@ -530,7 +530,7 @@ private static function seopress_post( $post, &$excluded ) {
 				'title'       => array( $stored['titles_title'] ?? '', $type['title'] ?? '', SeoRender::DEFAULTS['seopress']['post'][0] ),
 				'description' => array( $stored['titles_desc'] ?? '', $type['description'] ?? '', SeoRender::DEFAULTS['seopress']['post'][1] ),
 				'robots'      => self::seopress_robots( $stored, $type, $options ),
-				'canonical'   => '' !== (string) ( $stored['robots_canonical'] ?? '' ) ? (string) $stored['robots_canonical'] : (string) get_permalink( $post ),
+				'canonical'   => '' !== (string) ( $stored['robots_canonical'] ?? '' ) ? (string) $stored['robots_canonical'] : Source::permalink( $post ),
 				'og'          => array( $stored['social_fb_title'] ?? '', $stored['social_fb_desc'] ?? '', '' !== (string) ( $stored['social_fb_img'] ?? '' ) ? $stored['social_fb_img'] : (int) get_post_thumbnail_id( $post ) ),
 				'twitter'     => array( $stored['social_twitter_title'] ?? '', $stored['social_twitter_desc'] ?? '', '' !== (string) ( $stored['social_twitter_img'] ?? '' ) ? $stored['social_twitter_img'] : (int) get_post_thumbnail_id( $post ) ),
 			),
@@ -571,7 +571,7 @@ private static function yoast_post_rendered( $post, $stored ) {
 				'title'       => array( $stored['title'] ?? '', $titles[ 'title-' . $type ] ?? '', SeoRender::DEFAULTS['yoast']['post'][0] ),
 				'description' => array( $stored['metadesc'] ?? '', $titles[ 'metadesc-' . $type ] ?? '', SeoRender::DEFAULTS['yoast']['post'][1] ),
 				'robots'      => self::site_robots( $robots ),
-				'canonical'   => '' !== (string) ( $stored['canonical'] ?? '' ) ? (string) $stored['canonical'] : (string) get_permalink( $post ),
+				'canonical'   => '' !== (string) ( $stored['canonical'] ?? '' ) ? (string) $stored['canonical'] : Source::permalink( $post ),
 				'og'          => array( $stored['opengraph-title'] ?? '', $stored['opengraph-description'] ?? '', '' !== (string) ( $stored['opengraph-image'] ?? '' ) ? $stored['opengraph-image'] : (int) get_post_thumbnail_id( $post ) ),
 				'twitter'     => array( $stored['twitter-title'] ?? '', $stored['twitter-description'] ?? '', '' !== (string) ( $stored['twitter-image'] ?? '' ) ? $stored['twitter-image'] : (int) get_post_thumbnail_id( $post ) ),
 			),
diff --git a/includes/class-contentrain-bridge-source.php b/includes/class-contentrain-bridge-source.php
index 6059f6f..4c4b931 100644
--- a/includes/class-contentrain-bridge-source.php
+++ b/includes/class-contentrain-bridge-source.php
@@ -101,7 +101,7 @@ public static function default_locale() {
 			return self::locale( pll_default_language() );
 		}
 		if ( has_filter( 'wpml_default_language' ) ) {
-			$default = apply_filters( 'wpml_default_language', null );
+			$default = apply_filters( 'wpml_default_language', null ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- WPML's own filter, spelled WPML's way.
 			if ( $default ) {
 				return self::locale( $default );
 			}
@@ -112,7 +112,7 @@ public static function default_locale() {
 	public static function language( $post ) {
 		$code = function_exists( 'pll_get_post_language' ) ? pll_get_post_language( $post->ID ) : null;
 		if ( ! $code && has_filter( 'wpml_post_language_details' ) ) {
-			$details = apply_filters( 'wpml_post_language_details', null, $post->ID );
+			$details = apply_filters( 'wpml_post_language_details', null, $post->ID ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- WPML's own filter.
 			$code = is_array( $details ) ? ( $details['language_code'] ?? null ) : null;
 		}
 		// An untagged post (Polylang does not manage every post type, e.g.
@@ -128,8 +128,8 @@ public static function translations( $post ) {
 		$translations = function_exists( 'pll_get_post_translations' ) ? pll_get_post_translations( $post->ID ) : array();
 		if ( ! $translations && has_filter( 'wpml_element_trid' ) ) {
 			$type = 'post_' . $post->post_type;
-			$trid = apply_filters( 'wpml_element_trid', null, $post->ID, $type );
-			foreach ( (array) apply_filters( 'wpml_get_element_translations', array(), $trid, $type ) as $code => $item ) {
+			$trid = apply_filters( 'wpml_element_trid', null, $post->ID, $type ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- WPML's own filter.
+			foreach ( (array) apply_filters( 'wpml_get_element_translations', array(), $trid, $type ) as $code => $item ) { // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound -- WPML's own filter.
 				$translations[ $code ] = (int) $item->element_id;
 			}
 		}
@@ -518,4 +518,25 @@ private static function texts( $value ) {
 		$walk( $value );
 		return $out;
 	}
+
+	/**
+	 * A record's permalink as a reader of the site would address it, whoever runs the export.
+	 * WordPress gives a private post a plain `?p=` link unless the current user may read it, and a
+	 * request authenticated with the connection key has no user; the exporter already reads the
+	 * record itself, so the address is built from the record as if published. Nothing is granted:
+	 * the copy never leaves this function, and WordPress is asked no capability question.
+	 */
+	public static function permalink( $post ) {
+		$post = get_post( $post );
+		if ( ! $post ) {
+			return '';
+		}
+		if ( 'private' !== $post->post_status ) {
+			return (string) get_permalink( $post );
+		}
+		$published              = clone $post;
+		$published->post_status = 'publish';
+		$published->filter      = 'raw'; // get_post() keeps a raw object as is; any other filter would refetch the private row.
+		return (string) get_permalink( $published );
+	}
 }
diff --git a/includes/class-contentrain-bridge-text.php b/includes/class-contentrain-bridge-text.php
index 2636905..87cd378 100644
--- a/includes/class-contentrain-bridge-text.php
+++ b/includes/class-contentrain-bridge-text.php
@@ -24,10 +24,10 @@ public static function render_states() {
 		$post = get_posts( array( 'post_type' => 'post', 'post_status' => 'publish', 'numberposts' => 1, 'orderby' => 'ID', 'order' => 'ASC' ) );
 		$page = get_posts( array( 'post_type' => 'page', 'post_status' => 'publish', 'numberposts' => 1, 'orderby' => 'ID', 'order' => 'ASC' ) );
 		if ( $post ) {
-			$states['single'] = get_permalink( $post[0] );
+			$states['single'] = Source::permalink( $post[0] );
 		}
 		if ( $page ) {
-			$states['page'] = get_permalink( $page[0] );
+			$states['page'] = Source::permalink( $page[0] );
 		}
 		/** Filters the pages whose rendered text is scanned (state => URL). */
 		return apply_filters( 'contentrain_bridge_render_states', $states );
@@ -261,7 +261,7 @@ public static function document( $candidates, $errors, $counts ) {
 	/** Text that is exported as content, so a page rendering it is not showing interface text. */
 	public static function content_texts() {
 		$texts = array( get_option( 'blogname' ), get_option( 'blogdescription' ) );
-		foreach ( get_posts( array( 'post_type' => 'any', 'post_status' => 'publish', 'numberposts' => 2000, 'fields' => 'ids' ) ) as $id ) {
+		foreach ( get_posts( array( 'post_type' => 'any', 'post_status' => 'publish', 'numberposts' => 2000, 'fields' => 'ids' ) ) as $id ) { // phpcs:ignore WordPress.WP.PostsPerPage.posts_per_page_numberposts -- Titles only (ids), once per export, to tell content apart from interface text; bounded.
 			$texts[] = get_the_title( $id );
 		}
 		foreach ( get_terms( array( 'hide_empty' => false, 'number' => 2000 ) ) as $term ) {
diff --git a/phpcs.xml.dist b/phpcs.xml.dist
new file mode 100644
index 0000000..f2b299f
--- /dev/null
+++ b/phpcs.xml.dist
@@ -0,0 +1,58 @@
+<?xml version="1.0"?>
+<ruleset name="Contentrain Bridge">
+	<description>WordPress coding standards and PHP compatibility for the files the plugin ships.</description>
+
+	<!-- The runtime files tools/package.py archives: nothing under tests/ or tools/ reaches a site. -->
+	<file>contentrain-bridge.php</file>
+	<file>uninstall.php</file>
+	<file>includes</file>
+
+	<arg name="extensions" value="php"/>
+	<arg name="colors"/>
+	<arg value="sp"/>
+	<arg name="parallel" value="4"/>
+
+	<!-- The plugin header promises PHP 7.4. -->
+	<config name="testVersion" value="7.4-"/>
+	<config name="minimum_wp_version" value="6.2"/>
+
+	<rule ref="WordPress-Extra">
+		<!-- Layout conventions this codebase does not follow: one-line methods and cases, unaligned arrays and
+		     assignments, inline associative arrays, the short ternary, non-Yoda literals, camelCase properties of
+		     third-party objects, parameter names such as $public that mirror WordPress's own filters, and class
+		     file names without the `class-` prefix WordPress-Extra expects. None bears on security, input
+		     handling, output escaping, database access, i18n or PHP compatibility: every sniff of those kinds runs. -->
+		<exclude name="Generic.Formatting.DisallowMultipleStatements"/>
+		<exclude name="Generic.Formatting.MultipleStatementAlignment"/>
+		<exclude name="PEAR.Functions.FunctionCallSignature"/>
+		<exclude name="PSR2.ControlStructures.SwitchDeclaration"/>
+		<exclude name="Squiz.Functions.MultiLineFunctionDeclaration"/>
+		<exclude name="Universal.NamingConventions.NoReservedKeywordParameterNames"/>
+		<exclude name="Universal.Operators.DisallowShortTernary"/>
+		<exclude name="WordPress.Arrays.ArrayDeclarationSpacing"/>
+		<exclude name="WordPress.Arrays.MultipleStatementAlignment"/>
+		<exclude name="WordPress.Files.FileName"/>
+		<exclude name="WordPress.NamingConventions.ValidVariableName"/>
+		<exclude name="WordPress.PHP.YodaConditions"/>
+	</rule>
+
+	<rule ref="PHPCompatibilityWP"/>
+
+	<rule ref="WordPress.WP.I18n">
+		<properties>
+			<property name="text_domain" type="array">
+				<element value="contentrain-bridge"/>
+			</property>
+		</properties>
+	</rule>
+
+	<rule ref="WordPress.NamingConventions.PrefixAllGlobals">
+		<properties>
+			<property name="prefixes" type="array">
+				<element value="contentrain_bridge"/>
+				<element value="Contentrain\Bridge"/>
+				<element value="CONTENTRAIN_BRIDGE"/>
+			</property>
+		</properties>
+	</rule>
+</ruleset>
diff --git a/readme.txt b/readme.txt
index ba09b7c..c6f4877 100644
--- a/readme.txt
+++ b/readme.txt
@@ -4,7 +4,7 @@ Tags: export, migration, headless, astro, content
 Requires at least: 6.2
 Tested up to: 7.1
 Requires PHP: 7.4
-Stable tag: 0.7.0
+Stable tag: 0.7.1
 License: GPL-2.0-or-later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
 
@@ -17,7 +17,7 @@ Contentrain Bridge turns your WordPress content into editable JSON and Markdown
 * Advanced Custom Fields groups and repeaters become their own models with their own named fields, not one anonymous bag of values.
 * Free software under GPL-2.0-or-later. No account, subscription or paid service is required for either delivery.
 * Your WordPress site is not modified. The plugin reads content and source files; it never patches a theme or plugin. The one exception is opt-in: a switch, off by default, that adds a group for Contentrain Migrate to the robots.txt WordPress serves (see External services).
-* Every export step is started by a logged-in administrator through a nonce-protected request.
+* Every export step is started by a logged-in administrator through a nonce-protected request, or, over the REST export API, by a program that administrator authorized with an application password or a connection key (see External services).
 * Exports run in bounded steps and can be resumed, so large sites do not depend on one long request.
 * Comment archiving is off by default. When enabled, email addresses, IP addresses and comment metadata are excluded.
 * Metadata that looks like a password, token, key, credential or personal identifier is never exported, including inside selected fields.
@@ -31,7 +31,7 @@ The plugin contacts no host other than this site unless you choose GitHub delive
 
 **GitHub** — used only when you enter a repository and a token in step 3 and start the delivery. The plugin then calls the GitHub REST API at api.github.com to read the target repository's default branch (or the base branch you name) and file list, upload the exported files, and create one new branch holding them. What is sent: the exported content files you reviewed, a commit message, and the token you supplied. Nothing is sent to Contentrain or to any other host, and no analytics or telemetry is collected. The token is used for those requests only and is never stored in the database or in the export. Delivery never writes to your default branch and never overwrites a file you edited in Git. GitHub's terms: https://docs.github.com/site-policy/github-terms/github-terms-of-service — privacy policy: https://docs.github.com/site-policy/privacy-policies/github-privacy-statement
 
-**REST export API (inbound)** — the plugin adds routes under `/wp-json/contentrain-bridge/v1/` that let a program you authorize start an export and read its files. The plugin sends nothing by itself: the program asks, with an application password of an administrator who has the export and manage_options capabilities. Contentrain Migrate uses these routes when you give it such a password to migrate this site; what Migrate then does with the content is governed by Contentrain's terms (https://contentrain.io/terms-of-service) and privacy policy (https://contentrain.io/privacy-policy). The program that starts an export chooses its scope: Migrate asks for private content (drafts, pending, scheduled, private and password-protected posts, never the password) and for comments, and the exported files carry each post's own status. Revoke the application password in your profile to end that access; exports expire after a day.
+**REST export API (inbound)** — the plugin adds routes under `/wp-json/contentrain-bridge/v1/` that let a program you authorize start an export and read its files. The plugin sends nothing by itself: the program asks, with an application password of an administrator who has the export and manage_options capabilities, or with a Contentrain Migrate connection key (below). Contentrain Migrate uses these routes when you give it such a password or key to migrate this site; what Migrate then does with the content is governed by Contentrain's terms (https://contentrain.io/terms-of-service) and privacy policy (https://contentrain.io/privacy-policy). The program that starts an export chooses its scope: Migrate asks for private content (drafts, pending, scheduled, private and password-protected posts, never the password) and for comments, and the exported files carry each post's own status. These routes only read: no remote call creates, edits or deletes posts, settings, files, users, plugins or themes; the plugin writes only its own temporary export files outside the web root and its own bookkeeping options. Revoke the application password in your profile (or the connection key on the Bridge screen) to end that access; exports expire after a day.
 
 **robots.txt (only when you turn it on)** — Tools > Contentrain Bridge has a switch, off by default, "Let Contentrain Migrate read my pages and media". It changes only the robots.txt WordPress itself serves, through WordPress's `robots_txt` filter, and contacts no host. When you turn it on, robots.txt gains one group for the `ContentrainMigrate` crawler: the rules your robots.txt gives every crawler (`User-agent: *`), without the lines that close the whole site (a Disallow matching `/`), followed by `Allow` lines for the REST API (`/wp-json/`), your uploaded media (`/wp-content/uploads/`) and `/`. By robots.txt's longest-match rule those Allow lines open only those paths: a rule such as `Disallow: /wp-` still keeps wp-admin closed. Paths you keep closed, such as wp-admin, stay closed to it, and every other crawler sees robots.txt exactly as before. Turning it off removes the group, and uninstalling the plugin removes the setting. If your site serves a robots.txt file from disk, WordPress cannot change it: the switch stays off and the screen shows the lines to add yourself.
 
@@ -62,7 +62,13 @@ Yes, when you include the Media type. Each upload and its generated sizes are co
 
 = What is the Contentrain Migrate connection key? =
 
-A way for Contentrain Migrate to read this site's content when your host blocks application passwords (some hosts strip the Authorization header they travel in). Create it under Tools > Contentrain Bridge and paste it into Migrate. It lets Migrate start and read content exports as you, nothing else: it does not open the rest of the WordPress REST API. It is shown once and only a fingerprint of it is stored. Paste it into Migrate within an hour; once Migrate has used it, it works for that one move until 14 days after it was created, until Migrate closes it when the move is done, or until you revoke it or create a new one. It can only be created and used over HTTPS. Nothing is sent from your site to Contentrain when you create it.
+A way for Contentrain Migrate to read this site's content when your host blocks application passwords (some hosts strip the Authorization header they travel in). Create it under Tools > Contentrain Bridge and paste it into Migrate.
+
+What it allows: Migrate can ask this site to prepare a content export and download it — published posts, pages and custom post types with their fields and metadata (secret-looking keys are always left out); if Migrate asks for it, draft, pending, scheduled, private and password-protected content too (never the password itself); media records (the files only if requested); categories, tags and menus; comments without email addresses or IP addresses; SEO, redirect and permalink settings; theme design settings; the names and versions of active plugins and the theme; and the number of published entries per content type.
+
+What it cannot do: it runs with no WordPress user and cannot change anything on this site — no post, setting, file, user, plugin or theme is written. It does not open the WordPress REST API, wp-admin or application passwords; it works only on the plugin's own export routes. The key is valid only while the administrator who created it still has the export and manage_options capabilities.
+
+Revoking: revoke it on the same screen at any time; creating a new key retires the old one, and revoking removes the exports it prepared. It is shown once and only a fingerprint of it is stored. Paste it into Migrate within an hour; once Migrate has used it, it works for that one move until 14 days after it was created, until Migrate closes it when the move is done, or until you revoke it or create a new one. It can only be created and used over HTTPS. Nothing is sent from your site to Contentrain when you create it.
 
 = Why would I let Contentrain Migrate read my pages and media in robots.txt? =
 
@@ -80,10 +86,16 @@ The active theme and child theme, and optionally the source files of active plug
 
 == Privacy ==
 
-The plugin stores export ownership and a source revision marker. It sends nothing anywhere on its own; an export leaves the site only when you download it, deliver it to GitHub, or authorize a program to read it through the REST export API with an administrator's application password or a Contentrain Migrate connection key. For a connection key the plugin stores a fingerprint of the key (never the key), the Migrate order it is paired with, and the time and IP address of its last use; creating a new key or revoking it, and uninstalling the plugin, removes them. Export files are written to a private, per-administrator directory, are removed on uninstall, and expire after a day. An export can contain site content, authors' display names and WordPress usernames, selected post metadata and, if you or the program you authorized chose it, privacy-minimized comments of every status (approved, pending, spam and trash) and draft, pending, scheduled, private and password-protected posts (never the password). A program authorized through the REST API chooses the scope; Contentrain Migrate asks for private content. Treat a downloaded export as you would a WordPress export file. If you deliver to GitHub, the exported content is sent to GitHub under the account whose token you provide; choose a private repository when the export includes draft or private content.
+The plugin stores export ownership and a source revision marker. It sends nothing anywhere on its own; an export leaves the site only when you download it, deliver it to GitHub, or authorize a program to read it through the REST export API with an administrator's application password or a Contentrain Migrate connection key. For a connection key the plugin stores a fingerprint of the key (never the key), the administrator who created it, the Migrate order it is paired with, the list of exports it started, and the time and IP address of its last use; creating a new key or revoking it, and uninstalling the plugin, removes them. A request made with the key runs with no WordPress user. Export files are written to a private, per-site directory outside the web root that only the server can read, are removed on uninstall, and expire after a day. An export can contain site content, authors' display names and WordPress usernames, selected post metadata and, if you or the program you authorized chose it, privacy-minimized comments of every status (approved, pending, spam and trash) and draft, pending, scheduled, private and password-protected posts (never the password). A program authorized through the REST API chooses the scope; Contentrain Migrate asks for private content. Treat a downloaded export as you would a WordPress export file. If you deliver to GitHub, the exported content is sent to GitHub under the account whose token you provide; choose a private repository when the export includes draft or private content.
 
 == Changelog ==
 
+= 0.7.1 =
+
+* A request made with a Contentrain Migrate connection key no longer runs as the administrator who created the key. It runs with no WordPress user at all; the key stays valid only while that administrator still has the export and manage_options capabilities, and the exports it starts are recorded in the plugin's own settings, never in a user's profile. A key can no longer reuse or replace an export the administrator started with an application password. Revoking the key also removes the exports it prepared. Nothing changes for Contentrain Migrate: every route, answer and error code is as before.
+* The Bridge screen, this readme and the privacy-policy text now say what the key lets Migrate read, that it cannot change the site, and how to revoke it.
+* The export screen sends its requests as plain form fields, each checked on its own, instead of one JSON blob; the REST export routes declare and check every parameter; the note about a server that does not read .htaccess names the kind of server (nginx, IIS, other) instead of repeating the server header. A coding-standards check (PHP_CodeSniffer with the WordPress ruleset) now runs in the plugin's own tests.
+
 = 0.7.0 =
 
 * A new switch under Tools > Contentrain Bridge, "Let Contentrain Migrate read my pages and media", lets you open your site to Contentrain Migrate when your robots.txt closes it to crawlers. It is off by default. It changes only the robots.txt WordPress serves, adds one group for Contentrain Migrate, keeps closed what you close for every crawler (wp-admin, for one), and changes nothing for other crawlers. If your robots.txt is a file on disk, or a CDN serves it, the screen shows the lines to add yourself.
diff --git a/tests/admin-dom.mjs b/tests/admin-dom.mjs
index 28a33ba..b441ed9 100644
--- a/tests/admin-dom.mjs
+++ b/tests/admin-dom.mjs
@@ -59,8 +59,25 @@ export function boot(script, { stages = STAGES } = {}) {
     steps.children.push(item);
   }
   const calls = [];
+  /** The form fields admin.js sends (`name`, `name[]`, `name[key][sub]`) back as the object it was given; numbers as numbers. */
+  const decode = (body) => {
+    const payload = {};
+    for (const [field, raw] of new URLSearchParams(body)) {
+      if (field === 'action' || field === 'nonce') continue;
+      const path = [field.replace(/\[.*$/, ''), ...[...field.matchAll(/\[([^\]]*)\]/g)].map((m) => m[1])];
+      const value = /^-?\d+$/.test(raw) ? Number(raw) : raw;
+      let at = payload;
+      for (let i = 0; i < path.length - 1; i++) {
+        const next = path[i + 1] === '' ? [] : {};
+        at = at[path[i]] ??= next;
+      }
+      const last = path[path.length - 1];
+      if (last === '') at.push(value); else at[last] = value;
+    }
+    return payload;
+  };
   const fetch = async (_url, init) => {
-    const payload = JSON.parse(new URLSearchParams(init.body).get('payload'));
+    const payload = decode(init.body);
     calls.push(payload);
     const answer = script(payload, calls);
     if (answer instanceof Error) throw answer;
diff --git a/tests/check-plugin.sh b/tests/check-plugin.sh
index 797d719..8151df9 100755
--- a/tests/check-plugin.sh
+++ b/tests/check-plugin.sh
@@ -14,11 +14,13 @@ status=0
 # hidden file; exclude it explicitly so the check passes from any worktree.
 "${cli[@]}" plugin check contentrain-bridge \
   --exclude-directories=tests,tools,dist,.github \
-  --exclude-files=.gitignore,package.json,package-lock.json,RELEASING.md,.git \
+  --exclude-files=.gitignore,package.json,package-lock.json,composer.json,composer.lock,phpcs.xml.dist,RELEASING.md,.git \
   --format=strict-json > "$here/.out/plugin-check.json" || status=$?
 node --input-type=module - "$here/.out/plugin-check.json" "$status" <<'JS'
 import {readFileSync} from 'node:fs';
-const findings = JSON.parse(readFileSync(process.argv[2], 'utf8'));
+const raw = readFileSync(process.argv[2], 'utf8').trim();
+// A clean run prints "Success: Checks complete. No errors found." instead of JSON.
+const findings = /^Success:/.test(raw) ? [] : JSON.parse(raw);
 if (!Array.isArray(findings) || Number(process.argv[3]) > 1) throw new Error('Plugin Check did not finish normally');
 const errors = findings.filter(row => row.type === 'ERROR');
 const warnings = findings.filter(row => row.type === 'WARNING');
diff --git a/tests/key.php b/tests/key.php
index 05e7b43..fed5035 100644
--- a/tests/key.php
+++ b/tests/key.php
@@ -11,6 +11,7 @@
 }
 require_once WP_PLUGIN_DIR . '/contentrain-bridge/contentrain-bridge.php';
 use Contentrain\Bridge\Files;
+use Contentrain\Bridge\Jobs;
 use Contentrain\Bridge\Key;
 use Contentrain\Bridge\Remote;
 
@@ -25,9 +26,44 @@ function check( $value, $message ) {
  * One REST request as an anonymous caller (or `$as`), the key where `$via` says:
  * `header`, `body` (form fields), `json`, `both` or `none`.
  */
+/**
+ * What WordPress saw during every keyed request, recorded before and after the route callback: the user id,
+ * whether anyone is signed in, and whether `manage_options` holds. With a key all three must stay 0 / false / false.
+ */
+$observed = array();
+$observe = static function ( $response ) use ( &$observed ) {
+	$observed[] = array( get_current_user_id(), is_user_logged_in(), current_user_can( 'manage_options' ) );
+	return $response;
+};
+add_filter( 'rest_request_before_callbacks', $observe, 1 );
+add_filter( 'rest_request_after_callbacks', $observe, 1 );
+/**
+ * Every capability question WordPress is asked while a keyed request runs: the answer must grant nothing to
+ * the user-less request, and no plugin callback may sit on `user_has_cap` or `map_meta_cap` to change it.
+ */
+$granted = array();
+$cap_questions = 0;
+add_filter( 'user_has_cap', static function ( $allcaps, $caps, $args ) use ( &$granted, &$cap_questions ) {
+	if ( ! Key::active() ) { return $allcaps; }
+	++$cap_questions;
+	foreach ( array( 'user_has_cap', 'map_meta_cap' ) as $hook ) {
+		foreach ( ( $GLOBALS['wp_filter'][ $hook ]->callbacks ?? array() ) as $set ) {
+			foreach ( $set as $cb ) {
+				$fn = $cb['function'];
+				$name = is_array( $fn ) ? ( is_object( $fn[0] ) ? get_class( $fn[0] ) : (string) $fn[0] ) . '::' . $fn[1] : ( is_string( $fn ) ? $fn : get_class( $fn ) );
+				if ( false !== stripos( $name, 'Contentrain' ) ) { $granted[] = "$hook: $name"; }
+			}
+		}
+	}
+	if ( array_filter( $allcaps ) ) { $granted[] = 'granted ' . implode( ',', array_keys( array_filter( $allcaps ) ) ) . ' for ' . implode( ',', array_map( 'strval', (array) $args ) ); }
+	return $allcaps;
+}, PHP_INT_MAX, 3 );
+$keyed_calls = 0;
 function call( $method, $route, $params = array(), $key = null, $via = 'header', $as = 0 ) {
+	global $observed, $keyed_calls;
 	wp_set_current_user( $as );
-	$request = new WP_REST_Request( $method, '/contentrain-bridge/v1' . $route );
+	$observed = array();
+	$request = new WP_REST_Request( $method, 0 === strpos( $route, '/wp/' ) ? $route : '/contentrain-bridge/v1' . $route );
 	$body = $params;
 	if ( null !== $key && in_array( $via, array( 'header', 'both' ), true ) ) { $request->set_header( 'X-Contentrain-Key', $key ); }
 	if ( null !== $key && in_array( $via, array( 'body', 'json', 'both' ), true ) ) { $body['contentrain_key'] = $key; }
@@ -40,6 +76,18 @@ function call( $method, $route, $params = array(), $key = null, $via = 'header',
 		$request->set_body_params( $body );
 	}
 	$response = rest_do_request( $request );
+	if ( null !== $key && 0 === $as ) {
+		// The explicit-principal rule, checked on every keyed call rather than once: no WordPress user before, during or after.
+		foreach ( $observed as $seen ) {
+			if ( array( 0, false, false ) !== $seen ) {
+				throw new RuntimeException( 'FAIL: a keyed request ran as a WordPress user: ' . wp_json_encode( $seen ) . " ($method $route)" );
+			}
+		}
+		if ( 0 !== get_current_user_id() || is_user_logged_in() || Key::active() ) {
+			throw new RuntimeException( "FAIL: a keyed request left a user or the key behind ($method $route)" );
+		}
+		++$keyed_calls;
+	}
 	return array( $response->get_status(), $response->get_data() );
 }
 function code( $data ) {
@@ -47,10 +95,14 @@ function code( $data ) {
 }
 
 $admin = get_user_by( 'login', 'bridge-admin' );
+// A private post in scope: its address is the one place WordPress answers differently to a user-less request.
+if ( ! get_posts( array( 'post_status' => 'private', 'post_type' => 'post', 'numberposts' => 1 ) ) ) {
+	wp_insert_post( array( 'post_title' => 'Key private ' . wp_generate_password( 6, false ), 'post_content' => 'Private body.', 'post_status' => 'private', 'post_type' => 'post', 'post_author' => $admin->ID ) );
+}
 $meta = Remote::META . get_current_blog_id();
 $_SERVER['REMOTE_ADDR'] = '203.0.113.7';
 $reset = static function () use ( $admin, $meta ) {
-	foreach ( (array) get_user_meta( $admin->ID, $meta, true ) as $id ) { if ( is_string( $id ) && preg_match( '/^[a-f0-9]{32}$/D', $id ) ) { Files::remove( Files::dir( $id ) ); } }
+	foreach ( array_merge( (array) get_user_meta( $admin->ID, $meta, true ), Key::exports() ) as $id ) { if ( is_string( $id ) && preg_match( '/^[a-f0-9]{32}$/D', $id ) ) { Files::remove( Files::dir( $id ) ); } }
 	delete_user_meta( $admin->ID, $meta );
 	foreach ( array( Key::OPTION, Key::SEEN, Key::EXPORTS ) as $option ) { delete_option( $option ); }
 	delete_transient( 'contentrain_bridge_key_fail_' . md5( '203.0.113.7' ) );
@@ -83,6 +135,14 @@ function code( $data ) {
 list( $status, $body ) = call( 'POST', '/exports', array( 'types' => array( 'post' ) ), $key );
 check( 400 === $status && 'bridge_key_pairing_required' === code( $body ), 'a key without contentrain_pairing: 400 bridge_key_pairing_required' );
 check( null === get_option( Key::OPTION )['pairing'], 'and it does not pair the key' );
+$failures_before = (int) get_transient( 'contentrain_bridge_key_fail_' . md5( '203.0.113.7' ) );
+list( $status, $body ) = call( 'POST', '/exports', array( 'types' => array( 'post' ), 'contentrain_pairing' => $pair ), 'x' );
+check( 401 === $status && 'bridge_key_invalid' === code( $body ) && (int) get_transient( 'contentrain_bridge_key_fail_' . md5( '203.0.113.7' ) ) === $failures_before + 1, 'a malformed key (not 43 base64url characters): 401 bridge_key_invalid, counted as a wrong key' );
+delete_transient( 'contentrain_bridge_key_fail_' . md5( '203.0.113.7' ) );
+list( $status ) = call( 'GET', '/wp/v2/users/me', array( 'contentrain_pairing' => $pair ), $key );
+check( 401 === $status, "the key opens no WordPress route: GET /wp/v2/users/me with the key is $status" );
+list( $status ) = call( 'GET', '/wp/v2/posts', array( 'status' => 'draft', 'contentrain_pairing' => $pair ), $key );
+check( in_array( $status, array( 400, 401 ), true ), "nor GET /wp/v2/posts?status=draft ($status)" );
 list( $status, $body ) = call( 'POST', '/exports/' . str_repeat( '0', 32 ) . '/read', array( 'contentrain_pairing' => $pair ), $key, 'json' );
 check( 404 === $status && 'bridge_not_found' === code( $body ) && $pair === get_option( Key::OPTION )['pairing'], 'Migrate\'s access check (a read of no export): 404 bridge_not_found, and the key is now paired with the order' );
 // ---- Counts before payment (Migrate gate item 10): the paired key reads WordPress's own published counts. ----
@@ -95,6 +155,13 @@ function code( $data ) {
 check( 201 === $status && false === $started['reused'], 'the header key starts an export: 201' );
 $a = $started['export']['id'];
 check( array( $a ) === Key::exports() && $pair === get_option( Key::OPTION )['pairing'], 'the export is the key\'s, and the key is paired with the order' );
+check( '' === get_user_meta( $admin->ID, $meta, true ), 'and nothing was written to the administrator\'s user meta' );
+$state = json_decode( Files::read( Files::dir( $a ), 'state.json' ), true );
+check( $admin->ID === (int) $state['owner'] && 'key' === $state['via'] && hash( 'sha256', $key ) === $state['key'], 'its state names the owner explicitly: the key\'s administrator, via key' );
+wp_set_current_user( $admin->ID );
+try { Jobs::read( $a ); $read = true; } catch ( RuntimeException $e ) { $read = false; }
+wp_set_current_user( 0 );
+check( ! $read, 'signed in as that administrator, Jobs::read() refuses the key\'s export: the key is the only principal that reads it' );
 list( $status, $again ) = call( 'POST', '/exports', $scope, $key, 'body' );
 check( 200 === $status && $a === $again['export']['id'], 'the key as a body field: the same scope is the running export, reused' );
 list( $status, $body ) = call( 'POST', '/exports', array( 'types' => array( 'post' ) ) + $scope, $key );
@@ -112,6 +179,8 @@ function code( $data ) {
 list( $status, $own ) = call( 'POST', '/exports', array( 'types' => array( 'page' ), 'media_files' => false ), null, 'none', $admin->ID );
 check( 201 === $status, 'the administrator starts an export of their own' );
 $b = $own['export']['id'];
+$state = json_decode( Files::read( Files::dir( $b ), 'state.json' ), true );
+check( $admin->ID === (int) $state['owner'] && 'app_password' === $state['via'] && array( $b ) === (array) get_user_meta( $admin->ID, $meta, true ), 'its state says via app_password, and it is listed in the administrator\'s user meta, not the key\'s option' );
 list( $status, $body ) = call( 'POST', "/exports/$b/advance", array( 'contentrain_pairing' => $pair ), $key );
 check( 404 === $status && 'bridge_not_found' === code( $body ), 'the key cannot advance it: 404' );
 list( $status, $index ) = call( 'GET', '/exports', array( 'contentrain_pairing' => $pair ), $key );
@@ -135,8 +204,66 @@ function code( $data ) {
 	$offset += $chunk['length'];
 }
 check( hash( 'sha256', $assembled ) === $info['sha256'], 'rawir.json read in chunks through the body-keyed route assembles to its hash' );
+check( '' === get_user_meta( $admin->ID, $meta, true ) || array( $b ) === (array) get_user_meta( $admin->ID, $meta, true ), 'after start, advance and read with the key, the administrator\'s user meta holds only their own export' );
+
+// ---- Parity: the same scope with the application password reads the same content (no capability-dependent read). ----
+list( $status, $parity ) = call( 'POST', '/exports', array( 'types' => array( 'post', 'page' ), 'media_files' => false ), null, 'none', $admin->ID );
+check( 201 === $status, 'the administrator starts the key\'s scope with the application password' );
+$p = $parity['export']['id'];
+for ( $i = 0; $i < 60; ++$i ) {
+	list( $status, $body ) = call( 'POST', "/exports/$p/advance", array(), null, 'none', $admin->ID );
+	if ( in_array( $body['export']['phase'], array( 'ready', 'failed' ), true ) ) { break; }
+}
+check( 'ready' === $body['export']['phase'], 'and advances it to ready' );
+list( , $plist ) = call( 'GET', "/exports/$p", array(), null, 'none', $admin->ID );
+$timed = array( 'bridge/manifest.json', 'bridge/site.json' );
+// Two exports a second apart differ in their second-granular clocks and nothing else; compare what is left.
+$untimed = static function ( $id, $path ) {
+	$doc = json_decode( (string) file_get_contents( Files::dir( $id ) . '/output/' . $path ), true );
+	$strip = static function ( &$node ) use ( &$strip ) {
+		if ( ! is_array( $node ) ) { return; }
+		foreach ( array( 'taken_at', 'fetched_at', 'export_date', 'generated_at', 'exported_at' ) as $clock ) { unset( $node[ $clock ] ); }
+		foreach ( $node as &$child ) { $strip( $child ); }
+	};
+	$strip( $doc );
+	return $doc;
+};
+$differ = array();
+foreach ( $list['files'] + $plist['files'] as $path => $meta_row ) {
+	if ( ! isset( $list['files'][ $path ], $plist['files'][ $path ] ) ) { $differ[] = $path; continue; }
+	if ( $list['files'][ $path ]['sha256'] === $plist['files'][ $path ]['sha256'] ) { continue; }
+	if ( in_array( $path, $timed, true ) || ( '.json' === substr( $path, -5 ) && null !== $untimed( $a, $path ) && $untimed( $a, $path ) === $untimed( $p, $path ) ) ) { continue; }
+	$differ[] = $path;
+}
+check( array() === $differ, 'the key export and the application-password export have the same files and hashes apart from the timestamped manifest and site.json (differing: ' . implode( ', ', $differ ) . ')' );
+$privates = static function ( $id ) {
+	$doc = json_decode( (string) file_get_contents( Files::dir( $id ) . '/output/bridge/inventory.json' ), true );
+	$out = array();
+	foreach ( $doc['records'] ?? array() as $r ) { if ( 'private' === ( $r['status'] ?? '' ) ) { $out[ $r['wp_type'] . ':' . $r['wp_id'] ] = $r['fingerprint']; } }
+	return $out;
+};
+check( array() !== $privates( $a ) && $privates( $a ) === $privates( $p ), 'a private record is inventoried with the same fingerprint, which covers its permalink, by the key and by the application password (' . count( $privates( $a ) ) . ' private)' );
+
+// ---- Reuse isolation: an export the administrator started is never reused, bound or replaced by the key. ----
+$scope2 = array( 'types' => array( 'page' ), 'media_files' => false, 'comments' => true );
+list( $status, $theirs ) = call( 'POST', '/exports', $scope2, null, 'none', $admin->ID );
+check( 201 === $status, 'the administrator starts an export with the application password' );
+$s = $theirs['export']['id'];
+list( $status, $mine ) = call( 'POST', '/exports', $scope2 + array( 'contentrain_pairing' => $pair ), $key );
+check( 201 === $status && false === $mine['reused'] && $s !== $mine['export']['id'], 'the key asking for the same scope gets a new export (201), not the administrator\'s (reused)' );
+check( ! in_array( $s, Key::exports(), true ) && in_array( $mine['export']['id'], Key::exports(), true ), 'the administrator\'s export is not bound to the key' );
+list( $status, $renewed ) = call( 'POST', '/exports', $scope2 + array( 'fresh' => true, 'contentrain_pairing' => $pair ), $key );
+check( 201 === $status && $mine['export']['id'] !== $renewed['export']['id'] && ! is_dir( Files::dir( $mine['export']['id'] ) ) && is_dir( Files::dir( $s ) ), 'fresh with the key replaces the key\'s own export and leaves the administrator\'s intact' );
+list( $status, $index ) = call( 'GET', '/exports', array(), null, 'none', $admin->ID );
+check( in_array( $s, array_column( $index['exports'], 'id' ), true ) && ! in_array( $renewed['export']['id'], array_column( $index['exports'], 'id' ), true ), 'the administrator still lists their export, and not the key\'s' );
+$n = $renewed['export']['id'];
+for ( $i = 0; $i < 60; ++$i ) {
+	list( $status, $body ) = call( 'POST', "/exports/$n/advance", array( 'contentrain_pairing' => $pair ), $key );
+	if ( in_array( $body['export']['phase'], array( 'ready', 'failed' ), true ) ) { break; }
+}
+check( 'ready' === $body['export']['phase'], 'the key\'s replacement export advances to ready' );
 list( $status, $rerun ) = call( 'POST', '/exports', array( 'types' => array( 'post' ) ) + $scope, $key );
-check( 201 === $status && $a !== $rerun['export']['id'] && array( $a, $rerun['export']['id'] ) === Key::exports(), 'once it is ready, a rerun with another scope starts: the same key, the same order' );
+check( 201 === $status && $a !== $rerun['export']['id'] && array( $a, $n, $rerun['export']['id'] ) === Key::exports(), 'once it is ready, a rerun with another scope starts: the same key, the same order' );
 $seen = get_option( Key::SEEN );
 check( '203.0.113.7' === $seen['ip'] && time() - $seen['at'] < 60 && true === Key::status()['used'], 'the last use is recorded: when, and from where' );
 
@@ -182,8 +309,12 @@ function code( $data ) {
 check( 401 === $status && 'bridge_key_required' === code( $body ), 'DELETE /key without the key: 401 bridge_key_required' );
 list( $status, $body ) = call( 'DELETE', '/key', array( 'contentrain_pairing' => 'order_other_0009' ), $replacement );
 check( 403 === $status && 'bridge_key_paired_elsewhere' === code( $body ), 'nor for another order' );
+list( $status, $started ) = call( 'POST', '/exports', array( 'types' => array( 'page' ), 'media_files' => false, 'contentrain_pairing' => 'order_test_0003' ), $replacement );
+$r = $started['export']['id'];
+check( 201 === $status && is_dir( Files::dir( $r ) ), 'the new key starts an export of its own' );
 list( $status, $body ) = call( 'DELETE', '/key', array( 'contentrain_pairing' => 'order_test_0003' ), $replacement );
 check( 200 === $status && true === $body['revoked'], 'DELETE /key with the key and its order: revoked' );
+check( ! is_dir( Files::dir( $r ) ) && array() === Key::exports(), 'and the key\'s export is removed with it' );
 list( $status, $body ) = call( 'GET', '/exports', array( 'contentrain_pairing' => 'order_test_0003' ), $replacement );
 check( 401 === $status && 'bridge_key_revoked' === code( $body ) && false === Key::status()['active'], 'then the key is answered as revoked, and the screen says no key' );
 wp_set_current_user( $admin->ID );
@@ -210,7 +341,11 @@ function code( $data ) {
 
 // ---- The application-password path is unchanged. ----
 list( $status, $index ) = call( 'GET', '/exports', array(), null, 'none', $admin->ID );
-check( 200 === $status && in_array( $b, array_column( $index['exports'], 'id' ), true ) && in_array( $a, array_column( $index['exports'], 'id' ), true ), 'signed in as the administrator, every remote export is listed as before' );
+check( 200 === $status && in_array( $b, array_column( $index['exports'], 'id' ), true ) && in_array( $p, array_column( $index['exports'], 'id' ), true ) && ! in_array( $a, array_column( $index['exports'], 'id' ), true ), 'signed in as the administrator, their own remote exports are listed and the key\'s are not' );
+list( $status, $body ) = call( 'GET', "/exports/$a", array(), null, 'none', $admin->ID );
+check( 404 === $status && 'bridge_not_found' === code( $body ), 'the administrator cannot read the key\'s export through REST either: 404' );
+check( $keyed_calls > 40, "every one of the $keyed_calls keyed requests ran with user 0, signed out, without manage_options, before and after its callback" );
+check( array() === $granted, "no capability was granted to a keyed request and no plugin callback sat on user_has_cap or map_meta_cap during $cap_questions capability questions (" . implode( '; ', $granted ) . ')' );
 
 $reset();
 delete_transient( 'contentrain_bridge_key_fail_' . md5( '203.0.113.8' ) );
diff --git a/uninstall.php b/uninstall.php
index b06d536..0fc70fc 100644
--- a/uninstall.php
+++ b/uninstall.php
@@ -22,7 +22,7 @@
 	delete_metadata( 'user', 0, 'contentrain_bridge_remote_jobs_' . $contentrain_bridge_site, '', true );
 	try {
 		\Contentrain\Bridge\Files::remove( \Contentrain\Bridge\Files::root() );
-	} catch ( \RuntimeException $contentrain_bridge_error ) {
+	} catch ( \RuntimeException $contentrain_bridge_error ) { // phpcs:ignore Generic.CodeAnalysis.EmptyStatement.DetectedCatch -- Nothing to do: the reason is below.
 		// An unavailable temporary volume cannot be removed by this process.
 		// The directory is private and contains no stored GitHub credentials.
 	}