An admin panel on the same hostname as the customer site shares a cookie namespace, a rate limit and a cross-site scripting blast radius. A cookie scoped to…
Forcing an index makes one query faster today and freezes a decision that the optimiser would otherwise revisit as the data changes. A hint is appropriate as a…
The runner, the assertions and the extensions are PHPUnit’s, which means adopting it is a syntax decision rather than a testing-framework migration. Both styles running in one suite…
For anything with personal or financial data, who looked at it is a question that gets asked, and a write-only audit log cannot answer it. Recording a list…
A baseline entry is historical debt and needs no justification; an ignore is a claim that the analyser is wrong and does. reportUnmatchedIgnoredErrors is on by default and…
A parallel suite gets a database per worker automatically and shares every other backing service, which produces failures that look exactly like ordering bugs. Redis is the one…
2.4 in August adds an audit command that checks the lock file against the Packagist advisory database, which several separate tools had been doing. Reading the lock file…