Asset Manager runs inside WordPress with administrator-level capabilities, so security reports are taken seriously.

Fixes land on the latest release only.

Please do not open a public issue for an unpatched vulnerability.

Use either channel:

1. GitHub Security Advisories — the Report a vulnerability form on this repository. This is the preferred route.
2. Email — contact SureFire Studios via the details on our site, with Asset Manager security in the subject line.

Please include, where you can:

• The plugin version and your WordPress and PHP versions
• The file and, if known, the line or function involved
• Steps to reproduce, ideally with a minimal proof of concept
• The privilege level required (unauthenticated, subscriber, editor, administrator)
• Your assessment of the impact

• We aim to acknowledge a report within 7 days.
• We will confirm the issue and share a rough remediation timeline.
• Once a fix ships, we will credit you in the release notes unless you prefer otherwise.

In scope — anything in this repository: the plugin PHP, the admin and public JavaScript, the stylesheets, and the shortcode output.

Findings we are particularly interested in:

• Cross-site scripting in the gallery output or the admin screen
• SQL injection through the shortcode attributes or the admin forms
• Missing or bypassable capability checks and nonce verification on the AJAX endpoints (get_attachment_preview, update_asset_order) or the admin form handler
• Exposure of files that should not be publicly downloadable

Out of scope:

• Vulnerabilities in WordPress core or in other plugins and themes
• Issues that require an already-compromised administrator account
• Missing security headers at the web-server level

• All admin writes require the manage_options capability and a verified nonce.
• Asset records live in the custom table {prefix}_asset_manager_assets; downloads are plain WordPress media library URLs, so any file added as a download is publicly reachable by anyone who has the URL. Do not use this plugin for files that need access control.
• The gallery renders only assets flagged active, but inactive assets are not otherwise protected — their media URLs remain valid.