How to report
Email support@nibwp.com with as much detail as you can. Do not open a public forum thread, a GitHub issue, or a normal support ticket for a security matter.
What to include
- The plugin version and WordPress and WooCommerce versions
- Steps to reproduce, ideally with a proof of concept
- What an attacker could do with it, and what access they need first
- Whether you have disclosed it anywhere else, and any deadline you intend to apply
What we do
| Stage | Timeline |
|---|---|
| Acknowledgement of your report | Within 2 business days |
| Initial assessment and severity | Within 5 business days |
| Fix released for critical issues | As fast as we can, usually days |
| Public disclosure in the changelog | After the fix is available |
Scope
In scope: the plugin code, the licensing endpoint and this website. Out of scope: your gateway, your merchant account, your host, and issues in WordPress or WooCommerce themselves, which should go to their own security teams.
Safe harbour
We will not pursue action against researchers who report in good faith, avoid privacy violations and data destruction, and give us reasonable time to fix an issue before disclosing it. Test against your own installation rather than someone else’s store.
Credit
We name reporters in the changelog unless you prefer otherwise. There is no bug bounty programme at present, which we would rather state plainly than leave you to discover.