If you find a security problem in our plugin, we want to hear about it, and we will treat it seriously.
How to reach us
Email security@documentation.quantumaddons.com.
You will find this on the Security tab in the plugin too.
What happens next
A person reads it. Not a queue, not a bot.
We are a small team and we answer our own support, which means your report goes directly to the people who wrote the code. That is genuinely faster than the alternative.
Please tell us privately first
Give us a chance to fix it before it becomes public. That is not us protecting our reputation. It is protecting the people running our plugin on their websites, who cannot patch a problem they have not been told about yet.
We will not argue with you, we will not send you a legal letter, and we will not pretend it is not a bug. We will fix it, ship it, and credit you if you want to be credited.
What counts
Anything that could expose an API key, allow a payment to be forged or processed twice, let someone read data they should not, or let a non-administrator do something only an administrator should do.
If you are not sure whether something counts, send it anyway. We would rather read ten reports that turn out to be nothing than miss the one that was not.
What we do ourselves
The plugin is monitored by Patchstack, and we run the official WordPress Plugin Check against every release.
We treat the basics as non-negotiable: everything sanitised, everything escaped, every query prepared, every admin action protected. Those are not features. They are the floor.