Security and production boundaries
Effective production settings
Section titled “Effective production settings”The reviewed Web config enables debug and includes permissive CORS headers. These are development settings, not a safe public deployment. Set the effective config/app.php values (not an unapplied production.php overlay): debug=false, http_always_200=false, support_php_files=false; restrict http_headers/CORS to your actual clients. Never combine a wildcard Allow-Origin with credentialed browser access. Verify effective headers through the real proxy.
Request and account security
Section titled “Request and account security”Explicitly authenticate and authorize each protected action/resource. Add CSRF protection to cookie-authenticated mutations, validate schema/size and encode output for its context. Query bindings protect SQL values; whitelist dynamic identifiers. Do not put request paths, controller names, template names or shell fragments into executable code. Use secure HttpOnly cookies with a deliberate SameSite policy and verify the Session bootstrap false-value limitation.
Files and external access
Section titled “Files and external access”Keep uploads non-executable and outside trusted templates/code. Validate actual file contents, constrain image conversion, restrict remote URL imports against SSRF and use controlled download authorization. Configure trusted proxy handling deliberately; do not trust forwarded IP/Host headers from arbitrary clients. Bind internal workers/register/admin listeners privately.
Errors, logging and release acceptance
Section titled “Errors, logging and release acceptance”Return safe production errors; avoid logging passwords, tokens, cookies, full personal payloads or provider secrets. Errors must preserve correct HTTP status. The helper response() and http_always_200 can change status/envelope semantics; use an explicit responseJson contract where required.
Audit the lock and test the real startup/runtime, not just Composer constraints. Known component defects and placeholder plugins are documented on their pages. These notes do not certify a complete security audit. For a report, follow the repository SECURITY policy; do not submit private exploit details into a public issue.
Startup/configuration · Session · Media · Compatibility. Source: Web 9e2ab3e and Engine 89dac7f. Reviewed 2026-10-17; Ivan Zorin / Localzet Group.