We build plugins that run on other people’s stores, so their security is our responsibility. If you find a weakness in one of our plugins or in this site, we want to hear about it, and we will treat you fairly for telling us.
Reporting a vulnerability
Email [email protected] with:
- the plugin (or the part of the site) and the version you tested;
- steps to reproduce, or a proof of concept;
- what an attacker could do with it;
- whether you would like to be credited, and under what name.
Please keep the report private until a fix is out: don’t post it on the WordPress.org forums, in a public issue, or on social media. Test only on sites you own or have permission to test, and stop as soon as you have shown the problem; never read, change or delete other people’s data.
We don’t run a bug bounty programme, so there is no payment. We do credit reporters in the changelog of the fix if they wish.
What to expect
- We confirm receipt within 2 business days, and tell you when we have reproduced the problem.
- We aim to fix a critical issue within 7 days and release it as a security update; other issues go into the next release. We tell you when the fix is out.
- Security releases are marked as such in the changelog. Customers who follow a plugin can ask to be emailed about security fixes only, and our paid plugins show a notice in the WordPress dashboard until the update is installed.
In scope
- Every Extendiment plugin, free or paid, in its current version.
- extendiment.com, including accounts, licenses and the APIs our plugins call.
Out of scope
- WordPress core, WooCommerce and other plugins or themes: report those to their authors (or to the WordPress security team).
- Payments: Lemon Squeezy runs our checkout and billing. Report problems there to Lemon Squeezy.
- Denial of service, spam, brute force against rate-limited forms, and social engineering of our team or customers.
- Findings from automated scanners without a working proof of concept, and missing best-practice headers or settings with no demonstrated impact.
- Issues that need a compromised administrator account to begin with.
Safe harbour
If you follow this policy, we consider your research authorised and won’t take legal action against you or report you for it. If a third party raises a legal matter over research that followed this policy, we will say so.
How we protect the site
License keys are stored encrypted and only ever shown masked. Accounts can use two-factor authentication and passkeys. Download links are signed and expire. Our plugins are reviewed for security before each release, and this site’s dependencies are kept up to date. Server logs are kept briefly, as our privacy policy describes.
Machine-readable contact details are at /.well-known/security.txt.