Security and Reporting Vulnerabilities

hafenstudios builds WordPress plugins and themes. Security holes happen to everyone who writes software – what matters is how quickly and how openly they are dealt with. If you find a vulnerability, this page gives you a clear route and a binding response time.

How to report a vulnerability

Send your report to our security address:

A helpful report names the affected product and its version, describes how the problem can be reproduced, and assesses the possible impact.

You are welcome to write to us encrypted; we will provide a key on request. Reports may expressly be made anonymously as well.

What you can expect from us

• Acknowledgement of receipt within two working days.
• An initial technical assessment within five working days.
• Ongoing updates on the status of the fix.
• Credit as the finder in the release notes, if you wish.

What we ask of you

• Give us reasonable time to fix the issue before you publish details – 90 days is customary.
• Do not access other people's data, and do not alter or delete anything.
• Where possible, test on your own installation, not on third-party websites.
• Do not use attacks that disrupt operation – denial-of-service attacks or social engineering, for example.

Scope

This policy covers all plugins and themes published by hafenstudios as well as the following websites:

Third-party services embedded in our pages are not covered.

No bug bounty programme

We currently do not pay bounties. What we do promise is a reply, a fix and – on request – credit.

Anyone who reports a vulnerability responsibly has no legal action to fear from us. We regard reports made within these rules as a welcome contribution to security.

Cyber Resilience Act

As a manufacturer of products with digital elements, we are subject to Regulation (EU) 2024/2847. From 11 September 2026 we will report actively exploited vulnerabilities and severe security incidents via the platform provided by ENISA, within the statutory deadlines.

This page is at the same time our policy for the coordinated disclosure of vulnerabilities.

In machine-readable form, the security contact is also available at /.well-known/security.txt, in line with RFC 9116.

Last updated: 1 August 2026

← Back to the home page