Community

Project links

• Source on GitHub

  The full source: the Rust core, the per-PHP glue, the lab, and this site. Stars, issues and pull requests welcome.

• Contributing guide

  How to report bugs, what we do and do not accept (defensive only, no exploit code), and how to work on the code.

• Code of conduct

  Contributor Covenant 2.1. Be kind; harassment-free participation for everyone.

• Security policy

  Report a vulnerability privately through GitHub. Please do not open a public issue for a suspected vulnerability.

Reporting a vulnerability

Howdah is a defensive tool, so we take reports about it seriously. Use GitHub's private vulnerability reporting (the repository's Security tab → Report a vulnerability) rather than a public issue. A bypass of a rule, a crash or hang in the extension, or a way to make Howdah itself consume excess memory are all in scope. Useful details: the Howdah version, the PHP version and SAPI, your configuration, and expected versus actual behaviour.

How to help

• Try it and report back. Run it in detect mode on a real server and tell us what you see — especially on PHP versions or platforms the coverage table has not reached.
• Send platform notes. Install details for a distro, panel or PHP source we have not documented.
• Add test cases. A legitimate request shape that should never be blocked, or a benign reproduction of an abusive shape (structure only, never a working exploit).
• Improve the docs or this site. Corrections to the comparison table or coverage wording are very welcome.

License

Howdah is dual-licensed under MIT or Apache-2.0, at your option. Contributions are accepted under the same terms.