This policy covers every repository under github.com/wppoland that has no SECURITY.md of its own, including all Plogins plugins (FREE on WordPress.org and PRO).
Email hello@wppoland.com with the plugin or project, the version and enough detail to reproduce the issue. Please do not open a public issue and do not test against a site that is not yours.
- Plugins: https://plogins.com/security/
- Machine-readable contact (RFC 9116): https://plogins.com/.well-known/security.txt
- Full coordinated disclosure policy: https://wppoland.com/en/security-policy/
We acknowledge a report within 2 working days and give a first assessment within 5. For a confirmed critical vulnerability in a plugin we publish, we ship a patch or withdraw the plugin within 7 days of confirmation.