So Far, So Good

Just needed a basic referral system for a clients woocommerce store. Added this plugin, did some testing, and it worked fine for testing. We’ll see how it goes for actual customers. I did run the plugin php code through chatgpt to see what it said. Here’s the response:

The code is coherent and implements the referral system you described. I don’t see obvious malicious behavior, hidden external requests, encoded code, or dangerous file operations.

The flow is:

1. A registered customer receives a reusable referral code.
2. A friend follows the referral link or enters that code.
3. The friend receives the configured discount.
4. When the order reaches Completed, the referral is recorded.
5. The plugin waits the configured hold period.
6. It creates a separate, single-use reward coupon restricted to the referrer’s email.
7. If the original order is fully refunded, cancelled, or failed, the reward is revoked when possible.

Good signs include:

• Database queries using WordPress preparation methods.
• Admin actions protected with permissions and nonces.
• Output and user-controlled input generally sanitized/escaped.
• Reward coupons restricted to the referrer’s email.
• Duplicate referral events prevented by order ID.
• Refund reversal and delayed rewards are genuinely implemented.
• No customer or order information is transmitted to Sawir or another service.

Important limitations

• “New customers only” is disabled by default. You must enable it in the settings.
• Rewards start only when an order becomes Completed, not Processing. For Swiss Villa’s physical orders, that likely means after fulfillment rather than immediately after payment.
• Self-referral prevention compares user IDs and email addresses. Someone could circumvent it with another account and email address. There’s no IP, address, payment-method, or device matching.
• Partial refunds do not cancel the reward. Only a full refund does.
• The friend’s referral coupon is reusable across customers. Its total usage limit and per-customer limit must be configured correctly.
• I don’t see explicit Checkout Block integration. It uses standard WooCommerce coupon systems, so it may work, but the code alone doesn’t prove full block compatibility.
• The reward-release process has a small concurrency risk: two simultaneous release attempts could theoretically create duplicate coupons. That’s unlikely but could be hardened.

My assessment: the code makes sense and looks reasonably responsible for a free version 1.0 plugin. It gives me more confidence than its low installation count alone did. I would still test it on staging before trusting it on the live store—not because I found malicious code, but because checkout, scheduled rewards, refunds, and subscription purchases need real-world verification.