This policy applies to The Hack Repair Guy's PHP Checker.

Please do not disclose vulnerabilities, exploit details or sensitive data in public issues, discussions, WordPress.org support forums or reviews.

Use GitHub private vulnerability reporting. A free GitHub account is required. If that route is unavailable or you prefer email, contact Jim Walker at jim@hackrepair.com. For email, use the subject Security report: The Hack Repair Guy's PHP Checker. Start with a minimal description; arrange a suitable private channel before sharing particularly sensitive material.

For general questions and non-security bugs, use the support links in the README.

• Plugin version and relevant WordPress/PHP versions.
• Affected feature and the permissions or other conditions needed.
• Reproduction steps using a local or staging site, with a minimal proof of concept if available.
• Expected behavior, observed behavior and likely security impact.
• A suggested fix or mitigation, if you have one.

Remove passwords, reset links, authentication tokens, personal data and private site logs. Do not send production credentials or database dumps. If you cannot reproduce safely, report what you observed without further testing.

Security fixes target the latest stable release. Older releases are not maintained as separate security branches. Please check the latest version when practical, but suspected vulnerabilities in older versions are still welcome. A report is not rejected solely because an upgrade is not possible.

We aim to acknowledge reports within 5 business days and provide an initial assessment or progress update within 10 business days. These are response targets, not guaranteed resolution deadlines. If you have not received an acknowledgment, follow up through the fallback contact above.

We will assess the report, discuss practical mitigations where possible and coordinate public disclosure with the reporter after a fix or mitigation is available. Timing depends on impact and investigation; no fixed repair deadline is promised. Reporter credit is offered with consent. Do not include exploit details in a public issue while coordination is in progress.

Test only systems and accounts you own or are explicitly authorized to assess. Prefer an isolated local or staging site. Avoid accessing other users' data, disrupting service, mass email, destructive actions or persistence. Stop if testing risks harm and report the observation privately.

PHP Checker performs static token-stream analysis of local PHP files in plugins, must-use plugins, and themes without executing their code. Optional report history and scan results are stored in the site database and include plugin, theme, and relative file names. Reports leave the site only when an administrator exports or emails them. This is not a malware scanner, firewall, or dynamic runtime test; passing static checks means only that no unguarded static compatibility issues were detected for the selected PHP target.

Security controls, automated checks and code reviews reduce risk; they are not a guarantee that the plugin or a WordPress site is free of vulnerabilities. Repository documentation describes intended behavior, not independent security certification.