Responsible Disclosure Policy

Last updated: November 2026

The security of our website and software is essential to us and our customers. Despite our care and best efforts, our website or software may still contain vulnerabilities. If you find one, please tell us as soon as possible so we can fix it.

By reporting a vulnerability or testing under this policy, you agree to these terms. They work alongside our Terms of Service and End User License Agreement (EULA).

1. Scope

You may test the following for vulnerabilities:

  • The Analyzine WordPress plugin: the latest released version, downloaded from Solvix Studio with a valid license key, installed on your own WordPress site.
  • analyzine.com, within the rules of this policy.
  • Analyzine’s license and update service, using only your own license key.

Only the latest version, with a valid license, counts. This policy covers only the latest released version of the Analyzine plugin, as listed in our release notes when you submit your report, used with a valid license bought from Solvix Studio. A vulnerability counts only if you can reproduce it on that version. Issues in older versions, issues already fixed in the latest version, and copies obtained from anywhere else (including redistributed, modified or “nulled” copies) are not covered.

Analyzine is a paid plugin. To test it, you need to buy a license from Solvix Studio on analyzine.com. Other Solvix Studio products and websites are not covered by this policy.

2. What we ask of you

  • Report your findings to [email protected], with “Security” in the subject line.
  • Tell us as soon as possible after you find the vulnerability.
  • Give us enough information to reproduce the problem, including the Analyzine version number you tested, which must be the latest release. Also include the URL, file or parameter, a description of the vulnerability, and step-by-step instructions with a proof of concept. Complex issues may need more detail.
  • Give us your contact information so we can reach you with questions.
  • Send one vulnerability per report, in English.
  • Keep it confidential. Do not share any information about the vulnerability with anyone else until we have fixed it and agreed a disclosure date with you (see section 5). This includes third-party vulnerability databases and bug bounty programs such as Patchstack, Wordfence, WPScan and HackerOne. Parallel reports pull our time away from fixing the issue and coordinating with our customers.
  • Do only the minimum needed to verify the vulnerability. If you reach personal data, orders or license keys that are not yours, stop. Report it straight away, and delete anything you saved.

3. What is not allowed

Doing any of the following without our written permission may result in a report to law enforcement, legal action against you, or both:

  • testing on sites or accounts you do not own, including our customers’ sites;
  • uploading malware, viruses, trojans or any other harmful code;
  • changing or deleting information;
  • changing system configuration;
  • keeping access longer than needed, or sharing access with anyone else;
  • denial-of-service attacks, load tests, spam or mass automated scanning;
  • social engineering, phishing or physical attacks on our staff, customers or offices;
  • anything that harms the availability of our website or services, or the systems of people who use our software;
  • asking for payment before you share the details, or threatening to publish them. This is extortion, not responsible disclosure.

If you believe you have found a vulnerability but cannot prove it without breaking these rules, contact us first and we will discuss how to proceed.

4. What you can expect from us

  • No legal action. If you act in good faith and follow this policy, we will not take legal action against you for the vulnerabilities you report to us. If someone else takes legal action against you for research you did under this policy, we will let them know it was authorized. We cannot authorize testing of systems we do not own, such as third-party services or customer sites.
  • Confidentiality. We treat every report as confidential. We will not share your personal information without your permission, unless the law or a court order requires us to.
  • Credit. With your permission, we will thank you by name or handle on our website and in the plugin’s release notes for each confirmed vulnerability.
  • Communication. We aim to confirm we have received your report within 2 business days, send our assessment of the vulnerability and the expected time to fix it within 5 business days, and keep you informed of our progress.
  • A fix. We aim to fix confirmed vulnerabilities as soon as possible, and within 60 days of your report. Serious issues come first. Complex issues may take longer, and if so we will tell you why.
  • Customer protection. When a fix is released, we will inform affected customers, as our EULA describes. We will explain the risk in plain language, tell them what to do, and help them apply the fix if they need it.

We decide how serious each issue is and whether it is a vulnerability at all. We may use the CVSS scoring system to guide that decision.

You allow us to use the information in your report to fix the issue, inform our customers and publish a security advisory. We may request a CVE ID ourselves. If the issue also affects another vendor’s software, we may share the relevant details with that vendor.

5. Disclosure

Please keep the details private until we have released a fix and our customers have had reasonable time to update. That is usually 30 days after the fix, and we will tell you the date. Publish only with our written agreement. If we have not fixed the issue within 90 days of your report, we will agree a disclosure date with you.

6. Rewards

We do not currently offer a bug bounty or pay any reward for reports. Sending a report does not entitle you to payment. Our thanks is the credit described in section 4. If you share a report with a third party or another program before we agree to disclosure, you lose that credit.

If we start a bounty program in the future, we will announce it on this page. It will apply only to reports received after that date.

7. What we do not consider a vulnerability

Please do not send output from automated scanning tools without verifying the vulnerability yourself. Invalid or low-quality reports take time away from real fixes, and we may close them without a reply. We only consider real vulnerabilities that you can show you personally can exploit. The following are not treated as vulnerabilities under this policy:

Denial of service and brute force

  • Denial-of-service vulnerabilities of any kind.
  • Brute-force or rate-limit issues without proof of abuse or a rate-limit bypass. This includes frequent requests to endpoints such as wp-cron.php.

Version, license and setup issues

  • Issues in any version older than the latest release, or issues already fixed in it, even if older versions are still installed on some sites.
  • Issues in copies of Analyzine not obtained from Solvix Studio, used without a valid license, or modified.
  • Issues that need an outdated WordPress, PHP or browser version.
  • Missing best practices without proof that they can be exploited, such as missing security headers or cookie flags, version or path disclosure, CORS settings that do not expose credentials or logged-in data, or missing or weak SPF, DKIM or DMARC records.
  • Public access to non-sensitive WordPress REST API endpoints.

Accounts and roles

  • Sessions that stay active after a password change, unless this allows unauthorized access to an account.
  • Issues that need an Administrator account, or a role with the unfiltered_html or manage_options capability. These users can already change the site.

Low-impact web issues

  • Self-XSS.
  • Clickjacking on pages with no sensitive actions.
  • CSRF on logout.
  • Open redirects with no security impact.
  • CSV injection.

Fake analytics data

  • Sending fake visits, events or orders to the Analyzine tracker. Any analytics tool accepts data from browsers, so it can always be forged. We do want to hear about it if the forged data leads to code execution, stored XSS or another real exploit in the dashboard.

Other software

  • Vulnerabilities in third-party software and services, including WordPress core, themes and other plugins, Polar, Cloudflare, CookieYes, SendGrail and Fluent Forms. Please report these to their vendors.

Known and theoretical issues

  • Issues we already know about, and duplicate reports. If several people report the same issue, we credit only the first.
  • Theoretical issues with no realistic way to exploit them.

8. Vulnerabilities we find ourselves

When we find a vulnerability in software or websites that we use, we inform the people responsible, following their own responsible disclosure policy.

9. Data breaches

Your privacy and the confidentiality of your data are very important to us. Despite the care we take, information could still leak. This is how we would handle it.

What we consider a data breach. A data breach happens when we know, or have good reason to suspect, that someone has gained unauthorized access to personal or business information you have trusted us with. This includes customer accounts, license keys and waitlist sign-ups. Payment details are handled by our payment provider, Polar, and are not stored by us. The data Analyzine collects on your site is stored in your own WordPress database. Keeping it secure is your responsibility, and a breach of your site is not a breach by us.

How we respond. Our first priority is to stop the leak and limit harm to the people affected. We will investigate how the breach happened, what data was involved and who had access to it, and take steps to stop it happening again. If a crime was involved, we will report it to the police.

Who we inform. We will inform the people and organisations affected by the breach. We will also notify the relevant data protection authorities wherever the law requires it.

To report a suspected data breach, email [email protected] with “Data breach” in the subject line.

10. Changes and governing law

We may update this policy at any time by publishing a new version on this page. The version in force when you submit your report applies to it. This policy is governed by the laws of the State of Wyoming, USA, the same as our Terms of Service and EULA.