Security policy
This website is a static publication. It does not ask for credentials and it does not host a PHP runtime. If you find a content error, a broken security header, or a claim that overstates a vendor fix, the correction path is the contact configuration on this site.
A security contact address is not configured yet. Until src/data/site.ts contains one, this site cannot receive a coordinated disclosure. Do not send exploit details to an unmonitored channel.
Report vulnerabilities in PHP itself through the PHP project's security process. This site will not publish exploit payloads or proof-of-concept requests.