# Security Policy

## Scope

This repository publishes a **proof-of-concept detector/validator** for the
WP2Shell WordPress vulnerability chain (CVE-2026-63030 and CVE-2026-60137).
It is intended for authorized security testing, disposable local labs, and
defensive research only. See [Legal and Ethical Use](README.md#legal-and-ethical-use)
in the README before running it against any target.

## Reporting a Vulnerability in This Tool

If you find a security issue in the scanner/validator code itself (for
example, unsafe handling of untrusted input, unintended state changes, or a
bug that could affect a host running the tool), please report it privately
rather than opening a public issue:

- Email: bhanu.chintalapudi@newfold.com

Please include:

- A description of the issue and its impact.
- Steps to reproduce.
- The affected file/function and, if possible, a suggested fix.

We aim to acknowledge reports within a few business days.

## Reporting the Underlying WordPress Vulnerabilities

CVE-2026-63030 and CVE-2026-60137 are already public and fixed upstream. Do
not use this repository to report new findings against live, non-consenting
WordPress sites. For WordPress Core issues in general, use the official
channel:

- https://make.wordpress.org/core/handbook/testing/reporting-security-vulnerabilities/

## Responsible Use Reminder

- Only run this tool against systems you own or are explicitly authorized to test.
- Prefer the provided `compose.yaml` disposable lab bound to `127.0.0.1`.
- Never expose a deliberately vulnerable WordPress instance to the public internet.