Please do not report security vulnerabilities through public GitHub issues.

Instead, report them privately by contacting the maintainer through https://www.linkedin.com/in/konkomaji/ and requesting a secure channel for details. Please include:

• A description of the issue and its impact.
• Steps to reproduce, or a proof of concept.
• The plugin version, WordPress version, and PHP version.

• An acknowledgement of your report as soon as it is reviewed.
• An assessment and, where confirmed, a fix in a timely patch release.
• Credit in the changelog if you would like it, once the fix is public.

In scope:

• The plugin PHP code under includes/ and the main plugin file.
• The admin actions, AJAX endpoints, and front-end shortcodes and endpoints.

Out of scope:

• Vulnerabilities in WordPress core, Tutor LMS, WooCommerce, or other third-party plugins and themes.
• Issues that require a compromised administrator account to exploit.
• The remote QR image endpoint, which is configurable and can be replaced with an offline generator via the wpcert_qr_png_path filter.

• All admin actions use nonces and manage_options capability checks.
• Input is sanitized on save; output is escaped.
• Generated files live in a protected uploads directory.