Only the latest release receives security fixes.

Please do NOT report security vulnerabilities through public GitHub Issues.

If you discover a security vulnerability in WP Dash or the WP Dash Bridge plugin, please report it responsibly via one of the following channels:

Use GitHub's built-in private vulnerability reporting:
Report a vulnerability

Send a detailed report to: giulioleone097@gmail.com

Use the subject line: [SECURITY] WP Dash — <brief description>

Please provide as much of the following information as possible:

• Type of vulnerability (e.g., SQL injection, XSS, authentication bypass, path traversal)
• Affected component (dashboard, WP Dash Bridge plugin, WP Dash Standalone plugin)
• Version(s) affected
• Step-by-step reproduction instructions
• Proof of concept (code, screenshots, video) — if available
• Potential impact (what an attacker could do if the vulnerability is exploited)
• Suggested fix — if you have one

• Security fixes are released as patch versions (e.g., v0.1.1)
• A GitHub Security Advisory (CVE) is published after the fix is available
• The reporter will be credited in the advisory unless they prefer to remain anonymous
• We ask reporters to keep the vulnerability private until the fix is publicly available

• WP Dash dashboard application (src/)
• WP Dash Bridge WordPress plugin (wp-bridge-plugin/)
• WP Dash Standalone WordPress plugin (wp-wpdash-plugin/)
• API authentication and token handling
• Data validation and injection vulnerabilities
• Authorization and access control issues

• Vulnerabilities in third-party dependencies (report upstream to the dependency maintainer)
• Issues already reported and tracked
• Social engineering attacks
• Denial of service (DoS) attacks

• Always use HTTPS — never expose WP Dash or the REST API over plain HTTP
• Keep WP Dash updated — subscribe to releases to be notified of security patches
• Rotate API tokens regularly — use the regenerate function in WP Dash Bridge settings
• Restrict API access by IP — use a firewall or .htaccess to limit who can reach the REST API
• Secure your .env file — never commit it to version control; ensure file permissions are 600
• Keep WordPress updated — use the integrity check endpoint to detect core file tampering

Security contact: giulioleone097@gmail.com
Commercial inquiries: giulioleone.com