Skip to content

Repository navigation

Security: AppitStudio/lnkflow-for-woocommerce

Security

SECURITY.md

Security Policy

Reporting a vulnerability

Email support@appitstudio.com. Do not open a public issue for security reports, and do not post one in the WordPress.org support forum — that forum is where readme.txt sends merchants for everything except this. You will receive an acknowledgement within 72 hours.

Scope notes

  • The LnkFlow API token is a server credential. The plugin stores it in the WordPress options table and never prints, logs, localises to JavaScript, or serialises it into queued action arguments.
  • The LnkFlow click ID (lnk_id) is public correlation data, not a secret, but it may constitute personal data — the plugin treats it under the same logging/retention rules as order data.
  • Conversion reporting fails open: a LnkFlow API failure must never block or break checkout, order processing, or refunds.

There aren't any published security advisories