Only the latest documented release line should be assumed supported unless stated otherwise in the release notes.
Because this repository tracks production custom code rather than a packaged plugin release channel, supported versions should be interpreted through the documented snippet source, release notes, and compatibility notes.
Do not report vulnerabilities in public GitHub issues or public pull requests.
Instead, report them privately through GitHub private vulnerability reporting: https://github.com/jeremy-burgos/elementor-form-hardening/security/advisories/new
Include:
- a clear summary
- affected version or release tag
- reproduction steps
- impact description
- proof-of-concept details if available
- any suggested mitigation
- whether the issue was observed in Code Snippets deployment, equivalent custom-code deployment, or both
Valid reports will be reviewed privately.
Fixes may be prepared in private and disclosed after a patch is ready.
Security-relevant reports may include:
- validation bypass
- trust-boundary failures
- unsafe normalization behavior
- unintended data exposure
- privilege misuse
- unsafe admin-side handling
- dependency-related exposure that materially affects this project
- snippet-loading behavior that creates unexpected execution scope
- deployment guidance that creates a realistic security risk
The following are generally out of scope unless a clear exploit path exists:
- purely stylistic code preferences
- hypothetical issues without reproduction
- support requests
- business-policy disagreement with free-email blocking itself
- disagreement with snippet deployment as an architectural choice, absent a concrete risk
Please allow reasonable time for review and remediation before public disclosure.