Security fixes are treated separately from normal bug reports.

If you find a vulnerability, please use GitHub's private vulnerability reporting / Security Advisory feature when it is available for this repository. Avoid opening a public issue that contains exploit details, credentials, private site data, cookies, nonces or access tokens.

A useful report includes the affected plugin version, the vulnerable code path, the required user role or permissions, steps to reproduce the issue, and the expected impact.

The supported release line is the latest 1.0.x version. Older development snapshots may not receive separate fixes.