Custom Auth & Lockdown handles authentication and gates access to site content, so security reports are the most valuable contribution you can make here.

Please do not open a public issue for an unpatched vulnerability.

Use either channel:

1. GitHub Security Advisories — the Report a vulnerability form on this repository. This is the preferred route.
2. Email — contact Surefire Studios via the details on our site, with Lockdown security in the subject line.

Please include, where you can:

• The plugin version and your WordPress and PHP versions
• The endpoint, shortcode or setting involved
• Steps to reproduce, ideally with a minimal proof of concept
• The privilege level required (unauthenticated, subscriber, administrator)
• Your assessment of the impact

• We aim to acknowledge a report within 7 days.
• We will confirm the issue and share a rough remediation timeline.
• Once a fix ships, we will credit you in the release notes unless you prefer otherwise.

In scope — everything in this repository: the authentication handlers, the lockdown access controls, the admin screens, the shortcodes and the Elementor widgets.

Areas we are particularly interested in:

• Lockdown bypasses. Any way for a logged-out visitor to read content the lockdown is meant to withhold — via a template, feed, REST route, sitemap, oEmbed, search, or an unexpected query. Two such bypasses (the REST API and RSS feeds) were fixed in 1.1.0.
• The unauthenticated AJAX endpoints: cal_login, cal_register, cal_forgot_password and cal_reset_password are registered for nopriv and reachable by anyone.
• The approval workflow — any way for a pending or rejected account to authenticate.
• Privilege escalation through registration (the role must always come from WordPress's default_role, never from the request).
• Password reset — token generation and validation go through WordPress core; a way to reset another user's password would be critical.
• Open redirects in the login, logout or lockdown redirect paths.

Out of scope:

• Vulnerabilities in WordPress core, Elementor, or other plugins and themes
• Issues requiring an already-compromised administrator account
• Distributed brute-force from many addresses — per-IP limiting cannot stop it on its own

These are deliberate, documented gaps rather than bugs:

• Brute-force protection counts per IP address, using REMOTE_ADDR. It is not a substitute for a WAF: an attacker with many addresses can still spread attempts across them, and a site behind a proxy must set cal_client_ip or every visitor will share one bucket. It is enabled by default and can be switched off in settings.
• Administrators bypass the approval requirement by design, so a misconfigured approval setting cannot lock the site owner out.
• Lockdown governs front-end delivery only. It does not protect files served directly from wp-content/uploads; anyone with a direct URL can still fetch them.