This website uses cookies

We use a few cookies to keep the site working. Anything else, like anonymous statistics, only with your permission. Accept all, reject the non-essential, or choose category by category. See our cookie policy.

Perforks
Browse products
security

Report it to us, privately.

Our products run inside other people's sites. We treat a security report as the most urgent email we can get.

[email protected]

How to report

Email [email protected] with the product and version, what an attacker could do, and the steps to reproduce it. Please do not open a public issue or post on the WordPress.org forums until a fix is out.

  • We confirm receipt within two business days.
  • We aim to ship a fix within 14 days for serious issues, and keep you informed until then.
  • We credit you in the changelog, unless you prefer otherwise.

How we build

  • Updates are signed; a plugin checks the signature before it installs one, so no server along the way can push code to your site.
  • No credentials are written to disk: Restora's restore runner reads the database settings from wp-config.php when it runs.
  • Backups live in a randomly named folder closed to the web, and download only through WordPress for an administrator.
  • Every release passes WordPress.org's Plugin Check and our own test suites before it ships.

Scope

Restora, Restora Pro, Pharos, Palatian, Vendra and this website. Social engineering, denial of service and reports from automated scanners without a working proof are out of scope.