Responsible Disclosure Policy

Keeping our site and our products safe is one of our top priorities. Even with the highest standards, vulnerabilities in our software and on our website might still exist. This is becoming increasingly true in software with the rise of powerful tools for spotting bugs and vulnerabilities.

If you spot anything, please let us know as soon as possible so we can fix it. – Please note: we do not offer a bounty program.

Report an issue

Scope:

We want to hear about vulnerabilities on the following domains:

Note: the intended default behaviour of WordPress should not be reported to us; if you believe it is a vulnerability then you should report it to the WordPress project.

You may test the following WordPress plugins for vulnerabilities:

We also sell premium licences for each of these plugins, to test these for vulnerabilities, please purchase a licence.

The following is explicitly NOT allowed:

Doing any of these things without explicit prior written consent from us may result in a report to law enforcement and/or legal action.

Uploading malware, viruses, trojans, etc.
Changing or removing information.
Changing the system configuration.
Sharing access with others.
Using denial-of-service attacks.
Anything that damages or has a negative impact on the availability of our websites, or the systems of the users of our software.

If you think you have found a vulnerability but feel you cannot produce proof of compromise without complying with the above restrictions, please contact us.

What you can expect from us:

- We treat every report with the highest confidentiality and will never share your personal information without your express consent, unless we are forced to do so by a legally binding court order.
- If you give us permission, we will credit you for reporting a confirmed vulnerability by putting your name in a thank-you section on our website and in the release notes.
- We will send you confirmation that we have received your report within one business day.

We will respond to a report within three business days with an assessment of the vulnerability and the expected time needed to fix the issue.
We will keep you informed of the progress we make in fixing the issue.
We aim to fix the issue you report as soon as possible. The maximum time we may take to fix any issue is 60 days after receiving the report.
For nuisance or nonsense reports (e.g. you are reporting the default behaviour of a WordPress website to us instead of to WordPress, or have an “exploit” that involves a logged-in user attacking themselves), we reserve the right to discard your report without reply.

What we do with vulnerabilities we find ourselves:

When we find vulnerabilities in software or websites we use, we will inform the responsible parties according to their responsible or coordinated vulnerability disclosure policy.

Bounties

We do not offer a specific bug bounty or participate in a bug bounty scheme organised by anyone else.

Demands for a reward will not be considered.

Please do not submit output from automated scanning tools without personally verifying the reported vulnerabilities.

We are primarily interested in vulnerabilities that can be demonstrably exploited and have a meaningful impact on our customers or systems. Reports concerning general best practice, theoretical or low-severity issues, or the standard behaviour of third-party software we use may be closed without further action, and we may not respond to each one individually.

Vulnerabilities in third-party software should be reported to its maintainers through their own disclosure programmes.

Reporting data breaches

Your privacy and the confidentiality of you and your data are very important to us. In spite of the care we take to protect your data, it is possible for information to leak. This is how we would handle such an event:

What we consider a data breach

A situation where we know or can reasonably suspect that unauthorised access to personal or business information entrusted to us has occurred.

How we respond to a data breach

After finding out about a data breach, our highest priority is fixing the leak and preventing damage to those concerned. We will investigate the breach to determine how and what data was leaked, what caused the breach and who had access to the leaked data. We will take action to prevent this from happening again. When we find that illegal acts have been a factor in the data breach, we will report this to the police.

Who we inform about a data breach

We will inform all persons and organisations affected by the data breach. We will inform the Information Commissioner's Office whenever personally identifiable information is involved.

What to do if you find something:

Report your findings to: [email protected]

Inform us of the vulnerability as soon as possible after you discover it.
Give us enough information to be able to reproduce the problem so we can fix it a.s.a.p. Usually the URL or file that contains the vulnerability and a description of the vulnerability is enough, but when the issue is complicated more info may be required.
Give us your contact information so we can contact you when we have questions.
Do not share any information regarding the vulnerability with third parties until it is fixed. This includes third-party vulnerability and bug bounty programs because this would cause us additional work coordinating communications that could be spent on fixing the vulnerability.
Be responsible by not taking any actions other than the minimum required to verify the vulnerability.