Security Policy

How we protect our plugins and licensing service, and how to report a vulnerability to us.

Last updated: 9 October 2026

How we protect the service

  • All traffic to mawplugins.com, support.mawplugins.com and api.mawplugins.com uses HTTPS with HSTS.
  • The licensing API runs on infrastructure in Frankfurt, behind a firewall with rate limiting and automatic blocking of repeated failed logins.
  • API keys and passwords are stored hashed. Payment and webhook events are verified by signature.
  • Software on the servers is updated regularly, and the database is backed up regularly.
  • Card payments are handled by Stripe. We never see or store card numbers.

Report a vulnerability

If you believe you have found a security issue in a MAW plugin, our website or our licensing API, email support@mawplugins.com with the subject Security report. Please include:

  • what you found and where (URL, plugin and version);
  • the steps to reproduce it;
  • the impact you think it has;
  • how you would like to be credited, if at all.

What to expect from us

  • We acknowledge your report within 3 working days.
  • We keep you updated while we investigate and tell you when a fix is released.
  • We prioritise fixes by severity and ship them in a plugin update.
  • With your permission, we credit you below once the issue is fixed.

Scope

In scope: the latest released version of each MAW plugin, mawplugins.com, support.mawplugins.com and api.mawplugins.com.

Out of scope: denial-of-service tests, social engineering or phishing of our team or customers, physical attacks, spam, findings in older plugin versions, reports that only contain automated scanner output, and services run by third parties such as Stripe, HubSpot or our hosting providers (report those to the provider).

Good-faith research

We will not take legal action against you for security research that follows these rules: test only with your own accounts and sites, do not access, change or delete other people's data, stop as soon as you reach sensitive data and tell us, and give us reasonable time to fix the issue before you publish anything.

Acknowledgements

No valid reports have been credited yet. Researchers who help us fix a vulnerability will be listed here, with their permission.