This page is a record of self-assessment by the developer. It is not a certification or audit by a third party. Since we also publish what is tested, please use it as one input when deciding whether to adopt GeckoFlag.
v1.11.0 has no unresolved issues of "High" or "Medium" severity (tested: 2026-10-28).
This round tested the changes since v1.10.0 (the Claude integration, text and background colors and dividers in rich text, and more), and also fixed issues that had been present in earlier versions. If you use v1.10.0 or earlier, we recommend updating to v1.11.0.
| Test | Tools (Version) | Findings (High / Medium / Low) | Action Taken |
|---|---|---|---|
| Dependencies | GitHub Advisory Database, FriendsOfPHP security-advisories (data as of 2026-10-28; 89 packages) | 0 / 0 / 0 | No known vulnerabilities in the libraries included in the distributed files. Known vulnerabilities in development-only libraries were resolved by updating them in v1.11.0 (development-only libraries are not included in the distributed files) |
| Static analysis / code review | Psalm 5.26.1 (taint analysis), PHPStan 2.1.17 (level 5), Semgrep 1.182.1, manual code review (changes since v1.10.0: the Claude integration API and tokens, rich text, staying signed in, software updates; plus the link output on every screen) | 1 / 1 / 3 | The High and Medium findings and 2 of the Low findings were fixed in v1.11.0. The remaining Low finding only occurs through the user's own actions, and its impact was confirmed to be limited. The High finding had been present in earlier versions |
| Leaked secrets | gitleaks 8.24.2 | 0 / 0 / 0 | Checked both the source code and the distributed files. Both of the 2 detections were false positives (such as sample strings in third-party libraries) |
| Fix verification | Functional checks in the test environment (PHP 8.3, MariaDB 10.11, Apache 2.4, Nginx 1.24, Chromium) | — | For each finding, confirmed that the original problem no longer reproduces |
| Dynamic scanning | Nuclei v3.11.1 (templates v10.5.1), run while logged out and as an administrator and a member | 0 / 0 / 0 | No issues |
| Permission testing | PHPUnit 12.5 (454 automated tests; in addition to the previous checks, confirmed that the Claude integration API refuses requests without a token, with a read-only token, from users who are not allowed, and when the feature is turned off, and never reaches projects the user hasn't joined) | 0 / 0 / 0 | No issues |
| Checks by server configuration | Manual (two ways of placing the public folder on Apache 2.4 and Nginx 1.24; 39 URLs including configuration files, logs, sessions, and stored files) | 0 / 0 / 1 | Fixed in v1.11.0: direct access to the file folder used by older versions (files) is now refused entirely on Apache as well. No other issues |
| Checklist | OWASP ASVS 5.0 Level 1 (70 items) | 50 of 56 applicable items met | Not reviewed this time (the result of v1.10.0 is carried over) |
| Claude integration extension | npm audit, gitleaks 8.24.2, mcpb validate, manual code review (geckoflag-1.0.0.mcpb) | 0 / 0 / 0 | No known vulnerabilities affecting the libraries included in the distributed file. Checked how the API token is handled and the restrictions on where requests are sent (HTTPS only, redirects not followed) |