Skip to content

Security: vitepw/processwire-vite-plugin

Security

.github/SECURITY.md

Security Policy

Reporting a Vulnerability

If you believe you have found a security vulnerability in the plugin, we highly appreciate your responsible disclosure. To report a security vulnerability, please follow these steps:

  1. Do Not create a public issue or disclose the vulnerability on public forums, blogs, or social media until it has been addressed and fixed.
  2. Privately Notify Us: Please send an email to [email protected] with all the details regarding the vulnerability you discovered.
  3. Include Details: In your email, provide a clear description of the vulnerability, the steps to reproduce it, and any relevant supporting information such as affected versions or configurations.
  4. Encryption: To encrypt your message, you can use our PGP key. Please request our PGP key in the initial email, and we will send it to you.
  5. Acknowledgment: After receiving your report, we will acknowledge the receipt of the vulnerability report as soon as possible and within 48 hours.
  6. Assessment: W will assess and investigate the reported vulnerability to verify its validity and impact.
  7. Fix and Disclosure: Once the vulnerability is verified and fixed, we will release an update addressing the issue. We will provide proper credit to you for responsible disclosure if you desire. We will also publish a security advisory to inform users of the vulnerability.

Issue Template (Optional)

If you prefer to submit the vulnerability report as an issue on our repository, please follow these guidelines:

  1. Title: Use a clear and concise title that describes the vulnerability (e.g., "XSS Vulnerability in Function ABC").
  2. Description: Provide detailed information about the vulnerability, including steps to reproduce it, affected versions, and potential impact.
  3. Affected Versions: List the module versions affected by the vulnerability.
  4. Proof of Concept: If possible, provide a proof-of-concept or code snippet that demonstrates the vulnerability.
  5. Any Other Relevant Information: Include any other information that may be helpful to understand the issue.

Please note that submitting the vulnerability report as an issue will make it publicly visible on the repository. If the vulnerability is severe, we encourage you to follow the private disclosure steps mentioned earlier.

Thank you for your cooperation and commitment to improving the security of the "Blackhole" module and the ProcessWire community.

Public PGP Key

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEZBIAAxYJKwYBBAHaRw8BAQdAh7pkTJIezZ6VS2lT72XIHac8ugDQX0Am1VjH
NEusVXK0JWouIGVpem1lbmRpIDxjb2RlQHNla3JldHNlcnZpY2VzLmNvbT6IkwQT
FgoAOwIbAwULCQgHAgIiAgYVCgkICwIEFgIDAQIeBwIXgBYhBCNVk5ERf/2OxVdR
iLOGJfMLB34YBQJkEgexAAoJELOGJfMLB34YyN0BANuaqgj6f0B/s+AkBp0AdQJc
Rz0M1GdFvsSUAaISNncTAP4jXxY5SGujAwhCmS0w5ErcPIvyPYtzZ93/waLRH9GX
DYiZBBMWCgBBFiEEI1WTkRF//Y7FV1GIs4Yl8wsHfhgFAmQSAAMCGwMFCQPDXa0F
CwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQs4Yl8wsHfhgDvAEAyKswZeeb
KA/qY0GbhvOBpAZfrv0C7gPV/ytfAplYdsoBANrCjo3RX86x0vIpv7WtvD1q3rPz
zX32/MctVWlfe/kDtCBmbHlkZXYgPGNvZGVAc2VrcmV0c2VydmljZXMuY29tPoiT
BBMWCgA7FiEEI1WTkRF//Y7FV1GIs4Yl8wsHfhgFAmQSB78CGwMFCwkIBwICIgIG
FQoJCAsCBBYCAwECHgcCF4AACgkQs4Yl8wsHfhhiKwD/QGyUsAt9moxG7LcCDse5
W1Gt5XVwv0cmB94FCK8KE+IA/3b/biFNS5p4t0HeNwm6rGurI0+o4dnfenD5F4zG
RccNuDgEZBIAAxIKKwYBBAGXVQEFAQEHQP7DyMOjKdYoJtIHqZTAuyTLAi5bGAjE
5lvxyFgKMVJlAwEIB4h4BBgWCgAgAhsMFiEEI1WTkRF//Y7FV1GIs4Yl8wsHfhgF
AmQSB7EACgkQs4Yl8wsHfhilmQD+Mm6eF58skQjVQnk02lZLB+eJN0taG7Krt4a6
sl7redcBANJNm+jcTNIIBFLdhppBL9Zo6Ic+dQEXHORzrzvNPykM
=298N
-----END PGP PUBLIC KEY BLOCK-----

There aren’t any published security advisories