Report a Vulnerability

1. How to report a vulnerability

If you believe you have found a security vulnerability in the Stack Guard WordPress plugin, this website or our licensing and update service, please email hello@wpstackguard.com with “Security report” in the subject. Please do not report it publicly until we have released a fix.

Helpful details:

• The Stack Guard version, and the WordPress and PHP versions, where you saw it.
• What an attacker could do, and what access they would need first.
• Steps or a proof of concept that reproduce it on a test site.
• How you would like to be credited, if at all.

2. What we commit to

• We acknowledge your report within 3 business days.
• We keep you informed while we investigate and fix it.
• We credit you in the release notes if you would like.
• We ship security fixes as a priority, and say so in the changelog so site owners know to update.

3. Safe harbor

We will not take legal action against research done in good faith that:

• tests only sites you own or have permission to test, never other people's sites;
• avoids harming data, privacy or service, including no denial of service and no spam;
• gives us a reasonable time to fix the issue before you disclose it.

4. Out of scope

• Problems that need an attacker to already be a WordPress administrator, unless they cross a boundary the plugin promises to keep.
• Missing security headers or best practices on this marketing site with no real impact.
• Reports from automated scanners without a working example.
• Social engineering of our staff or customers.

5. security.txt

Our contact details are also published at /.well-known/security.txt.