Reporting vulnerabilities privately.

Open a private vulnerability report on GitHub (preferred) or email billy@trooper.es with the subject line Neopress security. Include the Neopress version or commit tested, steps to reproduce or a proof of concept, the security impact, and any suggested fix.

We aim to acknowledge your report within 5 working days and provide a first assessment within 10 working days. Please keep the issue private until a patch release and GitHub Security Advisory are published, or for 90 days, whichever comes first. We credit reporters unless you prefer to stay anonymous.

neopress-server (public site, /n-admin portal, /wp-json/* REST APIs, authentication and sessions, file uploads, JSON bundle and WXR importers) and the WordPress migrator plugin (neopress-migrator.php).

Vulnerabilities in the source WordPress site you migrate from, volumetric DoS attacks, automated scanner output without demonstrated impact, and actions requiring an already-compromised administrator account (unless escaping normal admin permissions such as remote code execution).

Set NEOPRESS_ADMIN_PASSWORD or change the generated first-run password immediately after first login, serve Neopress behind HTTPS via a reverse proxy (like Caddy or Nginx), and keep regular backups of data/neopress.sqlite and uploads/.