Please do NOT report security vulnerabilities through public GitHub issues.

If you discover a security vulnerability, please send an email to:

📧 tahir.alichana@gmail.com

Include the following information:

• Affected plugin version
• GLPI version
• Description of the vulnerability
• Steps to reproduce (if applicable)
• Potential impact assessment

You should receive a response within 72 hours. If the vulnerability is confirmed, we will:

1. Acknowledge receipt of the report
2. Investigate and assess the impact
3. Develop and test a fix
4. Release a patched version
5. Credit you in the release notes (unless you prefer to remain anonymous)

This plugin:

• Uses GLPI's built-in $DB->request() iterator with parameterised queries — no raw SQL interpolation
• Passes all output through htmlspecialchars() with ENT_QUOTES — no XSS vectors
• Requires an authenticated GLPI session for all pages — no unauthenticated access
• Does not write to the plugin source directory — user-generated files go to GLPI_PLUGIN_DOC_DIR/virtualcapacity