Responsible disclosure
Report security issues without increasing exposure
Do not publish credentials, live-site data, exploit details, or private update-channel locations in a public issue.
01
What to preserve
- Affected released versions
- A minimal reproduction on a disposable site
- Non-secret request and response metadata
- Relevant audit event identifiers
- Expected and observed behavior
02
What not to send publicly
- WordPress passwords or Application Passwords
- OAuth access or refresh tokens
- Private update URLs or signing material
- Customer content or personal data
- A working exploit against a live site
03
Contact status
A public security mailbox has not yet been published. Until one is supplied, preserve the evidence privately and do not open a public vulnerability report containing sensitive details.
04
Safe testing
Use a disposable site, request the narrowest scope, stop before a destructive result, and revoke test credentials when the observation is complete.