This repository is the Form plugin for Grav. It follows the Grav project's security policy: getgrav/grav SECURITY.md. Please read it before filing, especially what we do and do not treat as a vulnerability.

All Grav security reports, including ones for this plugin, go through one place: Grav's security page at https://github.com/getgrav/grav/security. Open an advisory there and name grav-plugin-form as the affected package. Please do not report security issues in a public issue or pull request.

For anything you would rather not put in the GitHub form, email security@getgrav.org first.

A report we can act on includes the exact plugin and Grav versions tested (with a commit hash), a minimal proof of concept we can run, and the threat model: what account or access the attacker starts with, what they end up with, and which trust boundary is crossed.

Severity follows Grav's trust-boundary rubric, not the CVSS score. See Severity in the core policy.