Security disclosure

If you believe you have found a security vulnerability in any Setyenv plugin or in the setyenv.com portal:

1. Do not open a public ticket, GitHub issue or write a blog post first.
2. Do send the details to [email protected] (PGP key fingerprint shipped in the plugin under SECURITY.md).
3. Include: affected plugin + version, reproduction steps, impact, any mitigation you can think of.

Our commitment back

• Acknowledgement within 1 business day.
• Triage + ETA for a fix within 5 business days.
• Coordinated public disclosure once the fix is shipped to all active licensees.
• Credit in the changelog if you want it (anonymous if not).

What is in scope

• Anything that lets a non-admin WP user gain admin capability.
• Anything that lets an unauthenticated visitor read, modify or delete data they should not.
• Anything that lets a workflow / agent / entity perform an action that bypasses the side-effect confirmation gate or capability checks.

What is out of scope

• Findings on a self-hosted install where the admin themselves configured something insecurely.
• Findings in third-party plugins or themes installed alongside.
• Anything requiring physical access to the WP server.