Tell us about a security problem
Found a security problem in HolmesPortfolio Forms, HolmesPortfolio Forms Pro or our store? Thank you for looking. Please tell us privately.
Email security@holmesportfolio.co.uk or use our contact form. A person reads every report.
Please don’t post it anywhere public. That includes the WordPress.org support forum.
Please include:
- the plugin version, or the page or address on our store where you found it
- what you found
- the steps to see it happen
Please update to the latest version before you report a problem. It may already be fixed.
What happens after you report it
We aim to reply within 5 working days. Then:
- we confirm we’ve received your report
- we keep you updated while we work on it
- we agree a date with you to make the problem public, normally within 90 days
- we may ask for a CVE (Common Vulnerabilities and Exposures) number for it
We release a fix as soon as we can. If you’d like, we’ll thank you by name in the changelog and on this page.
How long you get security fixes
HolmesPortfolio Forms (free)
Security fixes are free. We give them for at least 5 years from the plugin’s first release on WordPress.org.
HolmesPortfolio Forms Pro
Security fixes for Pro are free too. You get them until the month shown as “Security fixes until” when you bought. That’s at least 5 years from Pro’s first sale.
You still get them after your licence runs out, on the sites where your key was already active.
A key we’ve switched off gets no updates. For example, that happens after a full refund, or when a free trial ends without payment. Our terms of sale have the full details.
Our store
The store only runs on our own site, so there’s nothing for you to update. We fix security problems in it on the live store.
How to stay safe
- Keep the plugins up to date. Fixes come in the latest version, so only the latest version gets them.
- Check the changelog when you update. Each line about a security fix starts with “Security:”.
- Check this page. Once a fix is out, we describe the problem here and tell you what to do.
For serious problems, we also email Pro customers. This is a service message, separate from any product news you’ve signed up for.
Pro updates come from our own licence server, not WordPress.org. Pro only installs an update that’s signed with the HolmesPortfolio release key, and only if it’s newer than the version you have. Each release’s SHA-256 checksum is in its release notes, so you can check a ZIP you downloaded yourself.
Security notices
There are no security notices yet. When there are, they’ll be listed here, newest first.