# Security Policy

This repository is the **Form** plugin for [Grav](https://github.com/getgrav/grav). It follows the Grav project's security policy: [getgrav/grav SECURITY.md](https://github.com/getgrav/grav/blob/develop/SECURITY.md). Please read it before filing, especially what we do and do not treat as a vulnerability.

## Reporting a vulnerability

All Grav security reports, including ones for this plugin, go through one place: **Grav's security page at https://github.com/getgrav/grav/security**. Open an advisory there and name `grav-plugin-form` as the affected package. Please do not report security issues in a public issue or pull request.

For anything you would rather not put in the GitHub form, email **security@getgrav.org** first.

A report we can act on includes the exact plugin and Grav versions tested (with a commit hash), a minimal proof of concept we can run, and the threat model: what account or access the attacker starts with, what they end up with, and which trust boundary is crossed.

## Severity

Severity follows Grav's trust-boundary rubric, not the CVSS score. See [Severity](https://github.com/getgrav/grav/blob/develop/SECURITY.md#pushpin-severity) in the core policy.