What you receive at the end of an assessment.

1. Executive summary

Within the authorized scope we identified one high, two medium and one low severity finding. The most important action is upgrading the PHP runtime, which no longer receives security fixes. None of the findings were exploited during the assessment.

2. Findings

• HIGH

  PHP runtime past end of life

  Recommendation: Upgrade to a supported PHP release in a scheduled maintenance window.

• MED

  display_errors enabled in production

  Recommendation: Disable display_errors and log errors server-side.

• MED

  Missing Content-Security-Policy header

  Recommendation: Introduce a CSP in report-only mode, then enforce.

• LOW

  Server version disclosed in headers

  Recommendation: Disable expose_php and server tokens.

3. Limitations

This report reflects the agreed scope at the time of review. It is not a guarantee that the environment is free of vulnerabilities.