Agnosis Theme is a single actively-developed theme with no maintained legacy branches — the latest release on the GitHub Releases page is the only supported version. Security fixes land in the next release, not backported.

Please don't open a public issue for a security vulnerability. Use GitHub's private Security Advisory form on this repository instead, so a fix can be prepared before the details are public.

Include as much of the following as you can:

• The affected version (Version: header in style.css).
• Steps to reproduce, or a proof of concept.
• The potential impact as you understand it.

This is a solo-maintained project, not a company with a dedicated security team — response times are best-effort, but every report is read and taken seriously.

In scope: the theme itself (functions.php, templates/, parts/, patterns/, theme.json, style.css). The companion agnosis plugin is a separate project with its own SECURITY.md — please report plugin-specific issues there instead.

A theme's attack surface is small by nature (no admin-post handlers, no REST routes, no database writes of its own) — the most realistic class of report here is an output-escaping gap in a template or a render filter in functions.php.

Please give a reasonable window to develop and ship a fix before any public write-up. A credit/acknowledgment is happy to be included in the fix's CHANGELOG.md entry if you'd like one — say so in your report.