# Security Policy

## Supported versions

Security fixes are provided for the current SHIELD-X release line. Older release packages are considered unsupported once a newer stable package is published.

| Product | Supported | Notes |
| --- | --- | --- |
| SHIELD-X 1.0.x | Yes | Current stable release line. |
| SHIELD-X bundled modules matching the current main release | Yes | Modules ship inside the supported SHIELD-X main plugin. |
| Earlier SHIELD-X release lines | No | Upgrade to the latest stable package before reporting unless the issue also affects the current release. |

## Reporting a vulnerability

Please report suspected SHIELD-X vulnerabilities privately before publishing details.

- Email: security@xerotact.com
- Include the affected SHIELD-X version, enabled modules, WordPress version, PHP version, server type, reproduction steps, proof-of-concept details, and impact.
- Do not include recovery tokens, license keys, database backups, restore-point archives, private logs, or other secrets in screenshots or shared diagnostics.
- If possible, test on a site you own or on a local/staging copy instead of a production third-party site.

Please do not open a public GitHub issue, forum post, review, or social media thread until we have coordinated disclosure.

## Response targets

We triage security reports by practical exploitability, affected surface, privileges required, and the availability of safe mitigations.

| Step | Target |
| --- | --- |
| Acknowledge receipt | Within 2 business days |
| Initial triage | Within 5 business days |
| Critical patch target | 7 calendar days after confirmed triage |
| High patch target | 14 calendar days after confirmed triage |
| Medium patch target | 30 calendar days after confirmed triage |
| Low / defense-in-depth target | Next planned maintenance release |

These are targets, not guarantees. Complex fixes, third-party coordination, or issues that require WordPress.org review may change the timeline. We will keep the reporter updated when timelines change.

## Disclosure coordination

After confirmation, we will coordinate a disclosure plan with the reporter. We may ask for extra validation, affected-version checks, or a short embargo while a patch is prepared and distributed.

When appropriate, public release notes will describe the affected component, severity, and upgrade guidance without exposing unnecessary exploitation details. Reporter credit is available on request unless the reporter prefers to remain anonymous.

## Safe harbor

We will not pursue legal action for good-faith security research that follows this policy, avoids privacy harm, and does not disrupt services.

Good-faith research means:

- Test only systems you own or are explicitly authorized to test.
- Stop immediately if you encounter private data, credentials, backups, recovery tokens, or customer content.
- Do not persist access, create backdoors, alter data, exfiltrate secrets, or degrade site availability.
- Do not use social engineering, phishing, spam, physical attacks, or denial-of-service techniques.
- Share enough detail for us to reproduce and fix the issue safely.

## Out of scope

The following reports are usually out of scope unless they demonstrate a practical security impact in the current supported release:

- Missing security headers on unrelated third-party services.
- Version disclosure without an exploit path.
- Clickjacking or CSRF reports on screens that do not perform sensitive actions.
- Self-XSS requiring administrator paste-execution.
- Rate-limit reports that require unrealistic traffic or do not affect protected SHIELD-X actions.
- Issues caused only by intentionally weakened server permissions, compromised administrator accounts, or modified plugin code.

## Update guidance

Administrators should keep SHIELD-X updated through normal WordPress plugin updates. Private SHIELD-X Extensions are distributed as the separate Xerotact SHIELD-X Extensions companion package and should be updated only through the licensed private update channel or a package supplied by Xerotact. Do not install executable extension ZIPs through the WordPress.org package.

## Uninstall purge

`SHIELDX_PURGE_ON_UNINSTALL` is the official opt-in purge switch. Define it as `true` before uninstalling only when you intend to permanently remove SHIELD-X settings, findings, logs, backups, restore points, and private storage.
