Visible Runcode Password

While the runcode password is only a cookie for that session, it is stored unencrypted. I strongly suggest that it be encrypted, and done in such a way that even if you knew the php code, that it could not be unencrypted easily.

Yes, all you need to do is close the browser and the cookie should be gone, but why have the risk.

Many people may use the same password for many other applications, so it really is not worth it to leave accessable.

Very good check especially for any future XSS problems that may happen, suprised the team didnt check this one already.

I'd like to see the process changed a bit to allow passwords with special characters. If I wanted to use a password with a # in it, I can't because it's passed on the URL and the # screws it up.

Thank you, it is implemented already and will be available in the next vBSEO Sitemap Generator release.