marcus
2f91c3e6af
The parts every wpallstars plugin needs: settings screen with search and an empty General tab, Read Me tab, features as classes, replaced plugins, the shared GitHub updater, release and check scripts, CI and the shared rules. scripts/rename-plugin.sh starts a new plugin; scripts/sync-core.sh keeps plugins' core files in step with this starter. Built with aidevops (https://aidevops.sh).
1.3 KiB
Security policy
Supported versions
Security fixes go into the latest release only. Update to it before reporting, and check that the problem is still there.
Reporting a vulnerability
Please do not open a public issue, pull request or discussion for a security problem.
Report it privately on GitHub: open the repository's Security tab and choose Report a vulnerability. Include:
- the WP Plugin Starter version, and whether it came from GitHub or WordPress.org;
- the WordPress and PHP versions;
- the feature involved and the settings needed;
- steps to reproduce it, and what an attacker gains (for example, which role they need and what they can then read or change).
We reply within 30 days, agree a fix and a date with you, and credit you in the changelog unless you would rather not be named. If it is urgent (for example, it is already being used against sites), report it on GitHub and also email security@evergreen.je with a link to the report. Follow-up emails are welcome.
Scope
In scope: the code in this repository, as installed from a GitHub release or WordPress.org.
Out of scope: other plugins, themes and services that WP Plugin Starter recommends, links to or works with (report those to their makers), and problems that need an administrator account, since administrators can already run code on their site.