mirror of
https://github.com/Heretek-AI/heretek-control-core.git
synced 2026-10-12 02:03:55 +00:00
28 lines
1.1 KiB
Markdown
28 lines
1.1 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
Please **do not** open a public GitHub issue for security vulnerabilities.
|
|
|
|
Report security issues privately using GitHub's built-in advisory mechanism:
|
|
|
|
**[Security → Advisories → New draft advisory](../../security/advisories/new)**
|
|
|
|
Include:
|
|
- A description of the vulnerability
|
|
- The file and line number where it occurs
|
|
- Steps to reproduce or a proof-of-concept
|
|
- Your assessment of impact and severity
|
|
|
|
We aim to acknowledge reports within **3 business days** and provide a fix or mitigation plan within **30 days** for confirmed vulnerabilities.
|
|
|
|
Responsible disclosure is appreciated. We will credit researchers in the release notes unless you prefer to remain anonymous.
|
|
|
|
## Scope
|
|
|
|
This plugin requires WordPress Application Password authentication for all tool calls. There are no unauthenticated attack surfaces. Vulnerabilities affecting only users with `manage_options` (Administrator role) are considered lower severity than those affecting `edit_posts` (Editor/Author role).
|
|
|
|
## Supported Versions
|
|
|
|
Security fixes are applied to the latest release only.
|