- bootstrap.php: disable display_errors/display_startup_errors in favour of
PHP's own error log, so an uncaught engine error can never leak a stack
trace or filesystem path to a client.
- LoginRateLimiter: cap tracked address/identity buckets at 20000, evicting
the least recently active first, so a distributed flood of distinct
addresses or login names cannot grow login-attempts.json without bound.
- Logger: prune expired audit logs probabilistically (1-in-100) instead of
on every request, since every request already builds a Logger and a full
directory scan on each one scales with total rotated log files.
Found during a self-review security audit; full findings available on
request.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Geoff MooreandClaude Sonnet 5