# Security

If you find a security problem in a Plugevity plugin or in this site, please tell us privately first. We will work with you to fix it and credit you if you want.

## How to report

Email **[security@plugevity.com](mailto:security@plugevity.com)** with:

-   the plugin and version (or the URL),
-   what an attacker could do,
-   steps to reproduce, or a proof of concept,
-   whether and how you want to be credited.

Reports in English or Portuguese are fine. You can also report through the [Wordfence](https://www.wordfence.com/threat-intel/) or [Patchstack](https://patchstack.com/database/) programs; we accept reports from both.

## What we commit to

Step

Target

Acknowledge your report

within 3 business days

Confirm whether it is a vulnerability, with a first assessment

within 10 business days

Ship a fix for a confirmed high or critical issue

as fast as possible, aiming for 30 days

Publish an advisory and credit you

after the fix is released

We will keep you informed along the way and agree a disclosure date with you.

## Safe harbor

We will not take legal action against anyone who, in good faith, finds and reports a vulnerability following this page. Please:

-   only test against your own WordPress installations, never someone else’s site,
-   do not access, change or delete other people’s data,
-   give us reasonable time to fix the issue before you disclose it.

## Out of scope

Reports from automated scanners with no demonstrated impact, missing security headers on their own, and social engineering of Plugevity people.

This policy is also published as [/.well-known/security.txt](https://plugevity.com/.well-known/security.txt).

Last updated: November 11, 2026

---

Source: https://plugevity.com/security/