# Security policy

## Supported version

Security fixes are provided for the latest LocalGuard Scanner release. Upgrade before reporting an issue that has already been fixed.

## Reporting a vulnerability in LocalGuard Scanner

Do not publish exploit details or sensitive site data in a public issue. Contact the plugin maintainer through the private channel supplied with the distribution source and include:

- the LocalGuard Scanner, WordPress, and PHP versions;
- whether the installation is single-site or Multisite;
- minimal reproduction steps using inert data;
- expected and observed behavior;
- the security impact, without real credentials or malware samples.

The project will acknowledge a complete report, reproduce it, prepare a fix, and coordinate disclosure. This file deliberately does not invent a monitored email address; distributors must add their real private contact before public release.

## If your WordPress site may be compromised

LocalGuard Scanner is a detection aid, not an incident-response replacement. Preserve logs and a forensic copy, take a tested backup, and use a known-clean device. Restore or clean through a reviewed process, then rotate administrator, hosting, database, SFTP/SSH, and API credentials as well as WordPress salts. Review newly created administrators, scheduled tasks, plugins, mu-plugins, uploads, and external access logs.

Do not paste live malicious code, passwords, tokens, private keys, database exports, or absolute server paths into a vulnerability report.
