Responsible disclosure policy.

A security product without a clear disclosure route pushes researchers toward whatever channel is available: a support ticket queue, a public forum, or a social media post. All three are worse for everyone, and the last one means the vulnerability is public while it is still unpatched.

So the process exists to make the right thing the easy thing: a direct route to the people who can fix it, an acknowledgement so the reporter knows it landed, and a commitment that reporting in good faith will not be treated as an attack.

That last point matters more than it sounds. Researchers weigh legal risk before they report, and organisations that have been hostile once stop receiving reports permanently, which does not make them more secure, only less informed.

Reports are acknowledged so the reporter is not left wondering whether it arrived. Assessment establishes reproducibility and severity, which occasionally means going back with questions: that is normal and not a sign the report is being dismissed.

Fixes for genuine security issues take precedence over feature work. Where a fix requires a plugin release, users are notified through the normal update channel, and the changelog records that a security issue was addressed without publishing exploitation detail before people have had a chance to update.

We credit reporters who want credit and respect the preference of those who do not. Coordinated disclosure timing is a conversation rather than a unilateral decision: a researcher who has waited reasonably and received nothing has every right to publish, and we would rather not be the organisation that makes that necessary.