If you discover a security issue in AutoLoadoper, please report it responsibly:

• Website: https://webiloper.ir
• Telegram: @webiloper

Please include:

• WordPress and PHP versions
• AutoLoadoper version
• Steps to reproduce
• Impact assessment (if known)

We aim to acknowledge reports within a reasonable timeframe and will coordinate fixes before public disclosure when appropriate.

Reports related to AutoLoadoper's admin AJAX handlers, autoload toggle logic, code scanner, history storage, and permission checks are in scope.

General WordPress core vulnerabilities or third-party plugin issues are out of scope unless directly triggered through AutoLoadoper.

AutoLoadoper protects vital WordPress core options (e.g. siteurl, home, active_plugins) with a Critical consent flow:

1. The admin sees a critical warning dialog.
2. They must press OK and then type exactly CONFIRM.
3. Without this consent, autoload cannot be disabled for those options.

If you believe this safeguard can be bypassed (CSRF, capability escalation, client-side-only checks, etc.), treat it as a high-severity report and contact us immediately.

Security fixes are provided for the latest stable release. Upgrade to the current version before testing or deploying fixes.

Disabling autoload on the wrong option can affect site behavior. Always back up your database before bulk changes. Ownership detection is heuristic — verify important options manually on production sites.