Security policy

English · Deutsch

For single WordPress sites and Multisite networks. Both have been supported since 2012.

Use private vulnerability reporting for suspected vulnerabilities, including the bundled Library or Updater. Do not open a public issue containing exploit details, credentials, tokens or private content.

Include plugin/component versions, WordPress/PHP versions, single-site or network context, a redacted reproduction and potential impact. David Decker assesses the report, coordinates a fix and disclosure, and communicates through the private report. No response deadline is promised. Ordinary questions and bugs belong in Issues or Discussions.

The latest stable release is the normal supported line. Security fixes use a patch release where compatible; any migration or requirement change is communicated explicitly. Unpublished maintenance code is not a released security fix.