phpcs.security.xml

<?xml version="1.0"?>
<ruleset name="WordPress Security Standards">
  <description>WordPress Security Standards</description>

  <!-- Use the main phpcs.xml as a base, but restrict to security checks -->
  <rule ref="phpcs.xml">
    <!-- Exclude non-security sniffs -->
    <exclude name="Generic" />
    <exclude name="Modernize" />
    <exclude name="PEAR" />
    <exclude name="PSR2" />
    <exclude name="Squiz" />
    <exclude name="Universal" />
    <exclude name="WordPress.Arrays" />
    <exclude name="WordPress.CodeAnalysis" />
    <exclude name="WordPress.DateTime" />
    <exclude name="WordPress.DB" />
    <exclude name="WordPress.Files" />
    <exclude name="WordPress.NamingConventions" />
    <exclude name="WordPress.PHP" />
    <exclude name="WordPress.Utils" />
    <exclude name="WordPress.WP" />
    <exclude name="WordPress.WhiteSpace" />
  </rule>
</ruleset>