This page is a record of self-assessment by the developer. It is not a certification or audit by a third party. Since we also publish what is tested, please use it as one input when deciding whether to adopt GeckoFlag.
v1.10.0 has no unresolved issues of "High" or "Medium" severity (tested: 2026-10-16 to 17).
The first round of testing was performed on the previous public release, v1.9.0, and the issues found were fixed at the same time.
| Test | Tools (Version) | Findings (High / Medium / Low) | Action Taken |
|---|---|---|---|
| Dependencies | GitHub Advisory Database, FriendsOfPHP security-advisories (data as of 2026-10-16; 89 packages) | 1 / 0 / 0 | A known vulnerability in CakePHP 5.3.6. Fixed in v1.10.0 by updating to CakePHP 5.3.7. Development-only libraries are not included in the distributed files |
| Static analysis / code review | Psalm 5.26.1 (taint analysis), PHPStan 2.1.17 (level 5), Semgrep 1.181.0, manual code review (uploads, permissions, authentication, XSS, updates, installer, IP restriction) | 1 / 7 / 12 | All fixed in v1.10.0. In addition, 5 of the 6 "Informational" findings were fixed |
| Leaked secrets | gitleaks 8.24.2 | 0 / 0 / 0 | Both of the 2 detections were false positives (such as sample strings in third-party libraries) |
| Fix verification | Functional checks in the test environment (PHP 8.3, MariaDB 10.11, Apache 2.4, Chromium) | — | For each finding, confirmed that the original problem no longer reproduces |
| Dynamic scanning | Nuclei v3.11.1 (templates v10.5.0), run while logged out and as an administrator and a member | 0 / 0 / 0 | No issues |
| Permission testing | PHPUnit 12.5 (256 automated tests confirming that, as an administrator, member, guest, or logged-out user, data in projects the user hasn't joined and the admin screens can't be accessed even by changing the ID in the URL) | 0 / 0 / 1 | Fixed in v1.10.0: opening some admin screens while logged out revealed that the screen exists (Low) |
| Checks by server configuration | Manual (two ways of placing the public folder on Apache 2.4 and Nginx 1.24; 28 URLs including configuration files, logs, and stored files) | — | Apache: no issues with the default configuration. Nginx: no issues once the recommended settings are added (without them, private files are visible, so please check the recommended settings) |
| Checklist | OWASP ASVS 5.0 Level 1 (70 items) | 50 of 56 applicable items met | 14 items not applicable (features not used, etc.). The 6 items not met (such as password requirements) are addressed by other measures |