Terms of use for this unofficial PHP security briefing

Acceptable use

You may read the pages, quote a passage with a link back to it, and use the version checker and the report forms for the purpose described on those pages. The site is a briefing for system administrators and developers. It is not a source of attack instructions.

No affiliation

phpvulnerabilities.app is not the PHP Group, php.net, the PHP Foundation, NVD, NIST, CISA, or any vendor named on the pages. Product and organization names appear so you can find the public source. Nothing here is an official notice, an endorsement, or a statement by those organizations.

No warranty

The pages are informational. They are not security advice that guarantees a system is safe, and they are not a promise that a version, a product status, or a mitigation is complete or current. Sources disagree, and a page can be wrong or out of date. You decide what to do on systems you run. The editors provide the site as it is, without warranties of accuracy, fitness for a particular purpose, or non-infringement.

Prohibited misuse

• Do not scrape or automate requests in a way that degrades the site for other readers, bypasses a rate limit, or hides behind a false identity to evade one.
• Do not impersonate this site, its editors, the PHP project, NVD, CISA, or a vendor.
• Do not use the site, its forms, or its text to break the law, to attack a system, or to request exploit code. The editorial policy does not publish payloads.

Advertising and other services

The site uses Google AdSense, publisher ID ca-pub-2709006554665614. When the configuration selects another partner, a placement with a key may load that partner; that partner is currently Adsterra. Those services may set cookies and use personal data to deliver and measure ads. Google describes its processing in How Google uses information from sites or apps that use our services, in Google’s privacy policy, and in Google’s advertising technologies policy. Adsterra’s privacy policy describes its own processing. Where a choice is required, advertising waits for it. Rejecting advertising leaves the pages readable. House cards are links on this site. The privacy notice records the consent rules.

Reports you submit

New exposure reports and outage reports are private until they are reviewed. Approved exposure reports can count toward public totals. A site name and URL from an exposure report are published only if you opt in and the editors can confirm that you control the site. Email addresses and notes from that form are not published. An approved outage report may be published with the site name, URL, country, type, times, and source link. The notes and the contact email stay private. The privacy notice states how long identifying fields are kept and how to ask for earlier deletion.

Governing law

These terms do not name a governing law or a court. If a dispute arises, the law that applies and the place of any proceeding are not specified here. They would have to be agreed by the people involved.

Contact

Questions about these terms go to contact@phpvulnerabilities.app. That mailbox belongs to the editors of this site. It is not an inbox of the PHP project, NVD, or CISA.