# Security policy

## Supported versions

Security fixes go into the latest release only. Update to it before
reporting, and check that the problem is still there.

## Reporting a vulnerability

Please do not open a public issue, pull request or discussion for a
security problem.

Report it privately on GitHub: open the repository's **Security** tab and
choose **Report a vulnerability**. Include:

- the WP Plugin Starter version, and whether it came from GitHub or
  WordPress.org;
- the WordPress and PHP versions;
- the feature involved and the settings needed;
- steps to reproduce it, and what an attacker gains (for example, which
  role they need and what they can then read or change).

We reply within 30 days, agree a fix and a date with you, and credit you in
the changelog unless you would rather not be named. If it is urgent (for
example, it is already being used against sites), report it on GitHub and
also email security@evergreen.je with a link to the report. Follow-up
emails are welcome.

## Scope

In scope: the code in this repository, as installed from a GitHub release
or WordPress.org.

Out of scope: other plugins, themes and services that WP Plugin Starter
recommends, links to or works with (report those to their makers), and
problems that need an administrator account, since administrators can
already run code on their site.