Report security problems privately to [email protected], or through the contact form if email is not an option. Never post them in Discord or anywhere else public: a public report is a disclosure before there is a fix.
What to include
- The KahunaCart version, from
bin/plugin kahunacart status, and which add-ons are installed. - The Grav version and the web server.
- What an attacker gets, and the smallest set of steps that shows it.
- Whether the store needs an unusual setup for it to work.
Send one report per finding.
What counts
| Examples | |
|---|---|
| In scope | Reading or changing another customer's or the store's data, completing an order without paying, downloading a file you did not buy, escalating an admin permission, running code |
| Out of scope | Findings that need an already-compromised admin account, missing headers with no exploit attached, automated scanner output with nothing behind it, anything in Grav core or another plugin |
What happens next
You get an acknowledgement, then an assessment once the report has been reproduced. Please give a fix a reasonable window before you disclose publicly. The advisory credits you unless you ask it not to.
Security fixes ship in the latest version only.