Reporting a vulnerability
We build security tools, so we take reports about our own software seriously. If you think you've found a security problem in a BlogSafe plugin or on blogsafe.org, please tell us privately first.
Email support@blogsafe.org with "Security report" in the subject.
What to include
- The product and version (for example, Debug 360 Pro 1.0.2), or the page on blogsafe.org.
- What the problem is, and what an attacker could do with it.
- Steps to reproduce it, ideally with a proof of concept on your own test site.
- How you'd like to be credited, if at all.
What happens next
- We aim to acknowledge your report within three working days.
- We'll confirm whether we can reproduce it and keep you informed as we work on a fix.
- We fix confirmed problems as quickly as their severity requires, release the fix, and credit you in the changelog unless you'd rather we didn't.
- Please keep the details private until a fixed version is available, so sites have a chance to update.
In scope
- BlogSafe plugins, free and paid, including Debug 360 and Debug 360 Pro.
- The blogsafe.org website, store, license and update service.
Please don't
- Test against websites you don't own or have permission to test. Use your own installation.
- Access, change or delete other people's data, or keep more of it than you need to show the problem.
- Run denial-of-service tests, send spam, or try social engineering or physical attacks.
If you follow these guidelines and act in good faith, we won't pursue or support legal action against you for your research.
Reports to third parties
You can also report through the WordPress.org plugin security team or a vulnerability database such as Patchstack or Wordfence. Letting us know as well helps us respond faster.