We actively provide security updates for the current major/minor release series and its immediate predecessor.

Please do not report security vulnerabilities through public GitHub issues.

Because this module handles core checkout processes, public disclosure of a vulnerability could disrupt live merchant storefronts. If you discover a security flaw, please report it responsibly by following these steps:

1. Email us privately: Send a detailed report to security@davix.uk [or use GitHub's private vulnerability reporting feature].
2. Include details: Provide a clear description of the vulnerability, steps to reproduce it, and any proof-of-concept code if available.

• Acknowledgement: You will receive a response acknowledging your report within 48 business hours.
• Status Updates: We will keep you updated on our progress as we validate and work on a fix.
• Resolution: Once a fix is validated, we will release a new tagged version and coordinate a public advisory if necessary.