The POSIMYTH team takes security seriously. If you discover a security vulnerability in SproutOS, please do not open a public GitHub issue.

Instead, report it privately via our helpdesk:

store.posimyth.com/helpdesk/

Please include:

• A description of the vulnerability
• Steps to reproduce the issue
• The potential impact
• Your SproutOS version, WordPress version, and PHP version
• Any suggested fix (optional but appreciated)

• Acknowledgement: within 48 hours
• Assessment: severity and impact within 5 business days
• Fix: critical vulnerabilities patched as quickly as possible, typically within 7-14 days
• Disclosure: coordinated with you after a fix is released

SproutOS is self-contained (no MCP Adapter, no Abilities API, no bundled third-party libraries) and built with layered protection:

• Administrator-only access — every REST route and (in the Developer Edition) every MCP tool requires the manage_options capability.
• Application Password auth — callers authenticate with a standard WordPress Application Password over HTTP Basic; no custom credential store.
• Workspace confinement — file tools are confined to the SproutOS workspace directory (uploads/sproutos-workspace/); theme-file edits are confined to the target theme directory. Path traversal is rejected.
• Protected posts — pinned post IDs cannot be modified or deleted through any surface. In the Developer Edition this is enforced even inside sprout/exec, blocking both WordPress-API and raw $wpdb writes to a protected post.
• Secret redaction — option and setting reads never return keys that look like secrets, tokens, passwords or salts.
• Executable-upload block — media uploads reject .php and similar executable types.
• Domain lock — once enabled, all calls are rejected if the site URL drifts (anti-clone).
• Rate limiting — a per-user / IP token bucket.
• Audit log — every call (and every rejection) across REST, MCP and sprout/exec is recorded.
• Input sanitization & prepared statements — inputs are sanitized with WordPress functions; database queries use $wpdb->prepare().

sprout/exec runs arbitrary PHP and is intentionally the most privileged capability. Its primary protections are the administrator-only gate and the audit log; the protected-post guards are best-effort defence in depth, not a hard sandbox. It ships only in the Developer Edition (never on WordPress.org) and can be disabled entirely via the SPROUT_MCP_DISABLE_EXEC constant or the sprout_rest_allow_exec filter.

In scope:

• Authentication or authorization bypass
• Path traversal or directory escape
• SQL injection
• Cross-site scripting (XSS) in the admin UI
• Sensitive data exposure

Out of scope:

• Vulnerabilities that require Administrator-level access (SproutOS is designed for administrators)
• The intended behaviour of the administrator-only sprout/exec tool
• Social engineering or attacks requiring physical server access

Thank you for helping keep SproutOS and the WordPress ecosystem secure.