Report a suspected security vulnerability privately through Security → Report a vulnerability. Include plugin and embedded component versions, WordPress/PHP versions, reproduction steps and impact. Do not include passwords, tokens or customer content. Ordinary support requests belong in Issues.
If the private reporting form is unavailable, contact the repository owner through an existing private GitHub channel; do not publish exploit details in an issue.
Reports are assessed privately. Fixes and disclosure are coordinated with the reporter; no guaranteed response deadline is promised. Use the current maintained plugin version. This policy also covers the bundled deckerweb Library and updater in this host.