PHPGuard/docs/SECURITY-READINESS.md

PHPGuard security assessment readiness

Status: not production-validated

The scan collects package inventory and upstream NVD PHP CVE candidates. A version match, lack of upgrades, or an available upgrade does not establish exposure or remediation.

Verified statuses

• Unverified is the default for unsupported distribution/vendor combinations, unknown package provenance, absent advisories, and network failures.
• Ubuntu's existing advisory adapter is intentionally fail closed until installed package provenance is independently proven at the installed-version level. Seeing an Ubuntu repository in APT policy is insufficient: the installed package may be from a PPA or custom build.
• Docker PHP is not covered by host package advisories.
• NVD discovery is bounded and may omit CVEs; no-results is not a clean security bill.

Before production release

1. Implement per-installed-version repository origin verification and test Ubuntu advisory response parsing against current fixtures.
2. Implement and test Debian, Red Hat-family, SUSE, Amazon Linux and Alpine advisory adapters using official vendor data and native package version comparison.
3. Add test fixtures for package manager outputs, package origin edge cases, CVE states, missing metadata, errors, and containers.
4. Run integration tests on each supported distribution with minimal and restricted SSH permissions.
5. Run Xcode build, UI checks, signing and notarization on macOS; this archive has not been built in Xcode here.

This package is a security-hardening development snapshot, not a production release.