Please report vulnerabilities privately through GitHub’s private reporting form. Do not disclose credentials, private content, or exploit details in public issues. Include the Türchenzeit, WordPress and PHP versions, steps to reproduce, and the potential impact. Never include access credentials or personal data. The maintainer assesses reports privately and coordinates fixes and disclosure.
Own door content is checked on the server and is excluded from the standard WordPress search and public REST reads. Linked posts and pages normally remain public. Optional original-content protection in a published calendar hides standard WordPress access until the earliest assigned opening. Public media URLs, external copies and third-party access paths are outside this protection. Exclude protected originals from full-page caches before enabling it.