Security

Security is built into our Products from the first line of code, not added afterward. Every plugin we ship follows WordPress coding standards, sanitizes and validates input, uses parameterized database queries, verifies signed callbacks with HMAC-SHA256 where applicable (such as payment gateway responses), and redacts sensitive values — passwords, card numbers, and secure hashes — from debug logs.

We support responsible disclosure and ask security researchers to report suspected vulnerabilities to us privately before any public disclosure. We commit to acknowledging reports promptly, working in good faith to understand and fix genuine issues, and crediting researchers (with permission) once a fix has shipped.

If you believe you have found a security vulnerability in a devmubs Product or on this website, please email [email protected] with a description of the issue, steps to reproduce it, and its potential impact. Please do not publicly disclose a suspected vulnerability until we have had a reasonable opportunity to investigate and release a fix.

When a security issue is confirmed, we prioritize a fix ahead of routine feature work and release it as soon as it is safely tested. Keeping your license's update eligibility active, as described in our License page, ensures you receive security updates without interruption.

We recommend the following for any WordPress site, regardless of which Products you use:

• Keep WordPress core, themes, and plugins updated at all times.
• Use strong, unique credentials and enable two-factor authentication where available.
• Serve your site over HTTPS.
• Maintain regular, tested backups independent of your hosting provider's own snapshots.
• Limit admin access to people who genuinely need it.

While we secure the code we ship, the overall security of your website is a shared responsibility. You are responsible for securing your own hosting environment, WordPress admin credentials, and any third-party plugins or themes you run alongside ours, as well as for applying updates we release in a timely manner.

Our own website and support systems are served over HTTPS, access to our infrastructure and email systems is restricted to authorized team members, and we rely on reputable hosting and email-delivery providers. We continually review our own operational security practices as our team and infrastructure grow.