Reporting a vulnerability
If you find a security issue in fennecpress.com or in Fennec Forms, Members, Learn or their Pro add-ons, email security@theschoellergroup.com. Please don't open a public issue or post about it until we have released a fix. Include the affected product and version or URL, what you found, steps to reproduce, and the impact you expect.
What we commit to
- Acknowledge your report within 2 business days.
- Give you an initial assessment and expected timeline within 5 business days.
- Fix confirmed issues as quickly as their severity requires, and tell you when a fix ships.
- Credit you in the release notes if you want to be credited.
Safe harbour
We won't pursue legal action against good-faith research that follows this policy: test only against your own accounts and your own WordPress installations, don't access or change other people's data, don't degrade our services (no denial-of-service, spam or social engineering), and give us reasonable time to fix the issue before disclosing it.
Out of scope
- Missing best-practice headers or banners with no demonstrated impact
- Reports from automated scanners without a working proof of concept
- Issues in third-party services we use, which should go to those vendors
- Issues that need a compromised device or administrator access to the WordPress site
Fennec Press is operated by The Schoeller Group LLC, a Florida limited liability company based in Florida, USA.