# CommentMate security policy

## Reporting a vulnerability

Please report suspected security issues privately to
[info@pluginhub.com.au](mailto:info@pluginhub.com.au). Do not post
security-sensitive details in a public support forum, public issue tracker, or
general review request.

Include the installed CommentMate version, WordPress and PHP versions, and a
redacted description of how to reproduce the issue. Do not send passwords,
database exports, raw review content, private file paths, share links, tokens,
session cookies, attachments, or signing keys. If evidence needs secure
transfer, contact us first so an appropriate method can be arranged.

## Supported versions

The newest stable CommentMate Free release is supported. Report reproducible
issues in official WordPress.org or PluginHub packages through the private
contact above, including any local modifications needed to reproduce them.

No fixed acknowledgement, remediation, or disclosure timetable is promised.

## Handling process

Reports are assessed privately, validated in a safe environment where
appropriate, and addressed in a later release or coordinated disclosure. We
will publish only the information customers need to update safely. Sensitive
material is requested only when necessary and only through an agreed secure
transfer process.