This policy covers every package in this repository, including rtcamp/wp-phpcs and rtcamp/wp-phpstan, which are developed here and published through read-only mirror repositories.

Please do not report security issues in public issues, pull requests or discussions.

Report them privately through GitHub instead: open the repository's Security tab and choose Report a vulnerability, or go straight to https://github.com/rtCamp/wp-tooling/security/advisories/new. The report stays visible only to you and the maintainers, and the fix, the release and the advisory are coordinated in that same thread.

Include what you can of:

• the affected package, command or config, and its version;
• the impact, and the conditions an attacker needs;
• steps or a minimal proof of concept that reproduce it.