v0.25.0

docs/SECURITY.md

@@ -11,8 +11,10 @@ Administration binds to loopback HTTP by default. Settings can enable a dedicate
 administration HTTPS listener, choose the application-managed certificate or a
 certificate from the inventory, persist a non-loopback bind and allow explicit DNS
 Host/Origin names. Remote persisted binding is accepted only with administration TLS.
-An explicit startup `--allow-remote-admin` can expose plain HTTP on a non-loopback address;
-that path should remain behind a trusted firewall/private network boundary.
+The normal installer, one-line bootstrap and reference service keep the plain-HTTP admin listener
+on loopback by default. An explicit startup `--allow-remote-admin` can expose plain HTTP on a
+non-loopback address; that path should remain behind a trusted firewall/private network boundary and
+should be replaced by Administration HTTPS for direct remote use.
 Passwords use salted Argon2id; password work has admission limits and runs off the
 network I/O path. Setup requires local filesystem authority or the one-time random
 capability. No default administrator/password is created.
@@ -77,6 +79,14 @@ not application-level authorization or message semantics. Frame/message limits o
 backend remain the backend's responsibility. Proxy buffers, tunnel/connection counts
 and inactivity timers bound proxy-side resource usage.
 
+Web Server PHP-FPM integration never forwards the client `Proxy` header as CGI `HTTP_PROXY`
+(httpoxy protection), regardless of optional Web Service hardening. FastCGI response framing and
+hop-by-hop headers are discarded and RustProxy owns downstream framing. PHP-FPM endpoints are
+limited to Unix sockets or loopback TCP. Optional custom FastCGI parameters are validated static
+operator values and cannot replace core CGI, `HTTP_*`, `PHP_VALUE` or `PHP_ADMIN_VALUE`; php.ini
+overrides use a dedicated validated `PHP_VALUE` map. Configurable request-body, response-header
+and stderr bounds keep the PHP connector resource usage explicit.
+
 ## Information and resource controls
 
 Access logging does not collect credential headers, query values, cookies, bodies