marcus
2f91c3e6af
The parts every wpallstars plugin needs: settings screen with search and an empty General tab, Read Me tab, features as classes, replaced plugins, the shared GitHub updater, release and check scripts, CI and the shared rules. scripts/rename-plugin.sh starts a new plugin; scripts/sync-core.sh keeps plugins' core files in step with this starter. Built with aidevops (https://aidevops.sh).
38 lines
1.3 KiB
Markdown
38 lines
1.3 KiB
Markdown
# Security policy
|
|
|
|
## Supported versions
|
|
|
|
Security fixes go into the latest release only. Update to it before
|
|
reporting, and check that the problem is still there.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Please do not open a public issue, pull request or discussion for a
|
|
security problem.
|
|
|
|
Report it privately on GitHub: open the repository's **Security** tab and
|
|
choose **Report a vulnerability**. Include:
|
|
|
|
- the WP Plugin Starter version, and whether it came from GitHub or
|
|
WordPress.org;
|
|
- the WordPress and PHP versions;
|
|
- the feature involved and the settings needed;
|
|
- steps to reproduce it, and what an attacker gains (for example, which
|
|
role they need and what they can then read or change).
|
|
|
|
We reply within 30 days, agree a fix and a date with you, and credit you in
|
|
the changelog unless you would rather not be named. If it is urgent (for
|
|
example, it is already being used against sites), report it on GitHub and
|
|
also email security@evergreen.je with a link to the report. Follow-up
|
|
emails are welcome.
|
|
|
|
## Scope
|
|
|
|
In scope: the code in this repository, as installed from a GitHub release
|
|
or WordPress.org.
|
|
|
|
Out of scope: other plugins, themes and services that WP Plugin Starter
|
|
recommends, links to or works with (report those to their makers), and
|
|
problems that need an administrator account, since administrators can
|
|
already run code on their site.
|