Security & Vulnerability Disclosure
Last updated 20 October 2026
We build a security product, so we take reports about our own security seriously. If you have found a vulnerability in WP SecureGate or wpsecuregate.com, please tell us privately first.
1. How to report
Use the contact form with the topic “Report a security issue”, or email [email protected] with “Security” in the subject. Please include:
- what is affected — the plugin version, or the page or API on wpsecuregate.com;
- the steps to reproduce it, and a proof of concept if you have one;
- what an attacker could do with it.
Please do not report vulnerabilities through public channels such as social media or public issue trackers.
2. What is in scope
In scope: the current release of the WP SecureGate plugin, this website, and the APIs the plugin uses on wpsecuregate.com.
Out of scope: denial-of-service and volume testing, social engineering or phishing, physical attacks, spam, reports about missing best-practice headers with no demonstrated impact, and third-party services we use (such as Dodo Payments or Cloudflare) — report those to their owners. Never test against sites you do not own, including our customers’ sites.
3. What happens next
- We acknowledge your report within 3 working days and keep you updated as we investigate.
- We fix confirmed issues as quickly as their severity requires, and ship plugin fixes through the signed update channel.
- With your permission, we credit you in the release notes for the fix.
- We do not currently run a paid bug bounty.
4. Good-faith research
If you research in good faith and follow this policy — you do not access or keep more data than you need to show the problem, you do not harm our users or degrade the service, and you give us a reasonable time (up to 90 days) to fix the issue before telling anyone else — we will not pursue legal action against you for that research.