Security at Curious

We take the security of our software and our clients’ websites seriously. If you think you’ve found a security vulnerability in anything we make, including the JobAdder Job Board plugin for WordPress, please tell us. We’ll work with you to fix it quickly.

How to report

Email [email protected] with:

  • what’s affected (product, version, URL)
  • what the issue is and how to reproduce it
  • the impact, as you see it
  • how you’d like to be credited, if at all

Please don’t include real personal data in your report. If you need to send something sensitive, ask and we’ll arrange a secure way.

For the JobAdder Job Board plugin, you can also report through the Patchstack Vulnerability Disclosure Program. The Patchstack team will help verify the issue, assign a CVE and pass it on to us.

What happens next

  • We’ll acknowledge your report within 2 working days (usually the next working day).
  • We’ll confirm whether it’s a vulnerability, and how serious, within 5 working days.
  • We’ll fix critical issues within 7 days (we aim for 72 hours), high-severity issues within 30 days, and others within 90 days, usually in our next release.
  • We’ll keep you updated, tell affected clients before anything is made public, and credit you if you’d like.
  • We’ll agree a disclosure date with you once a fix is available. That will be no later than 90 days after your report.

In scope

  • The JobAdder Job Board plugin for WordPress (current version)
  • Other plugins, themes and software published by Curious Web Ltd

Out of scope

  • Our clients’ websites and hosting (please report those to the site owner), and third-party services such as JobAdder or WordPress itself
  • Denial of service, spam, social engineering and physical attacks
  • Issues that need an already-compromised administrator account or server

Safe harbour

If you act in good faith we won’t take legal action against you. That means:

  • you follow this policy;
  • you avoid privacy violations, data destruction and service disruption;
  • you only test against your own installation, not client sites;
  • you give us reasonable time to fix the issue before telling anyone.

We don’t currently run a paid bug bounty.

Last reviewed: November 2026