Security disclosure policy

Reporting

Email security@airythemes.com. You do not need an account, and you do not need to be a customer.

Please include enough to reproduce it: the affected product and version, the steps, and what you were able to reach.

A security report is never gated on a support term. §13.2 of our own build rules makes that explicit — refusing a vulnerability report is how a zero-day gets published instead of disclosed.

What we will do

• Acknowledge your report within 2 business days.
• Tell you our assessment, and whether we agree it is a vulnerability, within 10 business days.
• Keep you updated while we fix it, and tell you when it ships.
• Credit you in the release notes if you would like to be credited.

Security fixes reach every customer, including those whose updates and support term has lapsed. That is deliberate: an unpatched site is a problem whether or not its owner is paying us.

What we ask

• Give us reasonable time to fix it before disclosing publicly — 90 days is the norm, and we will usually be much faster.
• Test against your own installation, not against another customer's site or our production systems.
• Do not access, modify or delete data that is not yours. If you encounter someone else's data, stop and tell us.
• No denial of service, no spam, no social engineering of our staff or customers.

Stay within those limits and we will not pursue you for the research. We do not currently run a paid bounty, and we would rather say so than imply one.

Out of scope

• Findings from automated scanners with no demonstrated impact.
• Missing hardening headers with no exploit path.
• Issues in third-party services we do not control.
• Weaknesses that require an attacker to already control the site or its database.

Machine-readable

This policy is referenced from /.well-known/security.txt (RFC 9116).