# Security Policy

This repository is the **Flex Objects** plugin for [Grav](https://github.com/getgrav/grav). It follows the Grav project's security process.

## Reporting a Vulnerability

Please report security issues privately to **security@getgrav.org**, or open a draft advisory on this repository under **Security → Advisories**. Do not open a public issue or pull request for a security problem.

A good report includes the exact plugin and Grav versions tested, a minimal proof of concept, and the threat model — what level of account or access the attacker needs, and what they gain.

## Severity

Severity is rated by Grav's trust-boundary guidelines, not by a CVSS score. See the [Grav SECURITY.md](https://github.com/getgrav/grav/blob/develop/SECURITY.md#pushpin-note-on-security-severity) for the rubric.