Why can there be false positives?

PHP is dynamic and static analysis relies on heuristics. Results should be verified during review and can be hidden via suppressions when verified.

How do I integrate Phoenix into my workflow?

Use Phoenix before releases or during review phases. Export reports as HTML/JSON and combine findings with manual verification.

Which vulnerabilities are detected?

Best-effort detection of common classes such as XSS, SQL injection, LFI/RFI, SSRF, XXE, deserialization, and other HTTP/OS/DB-related risks.

Disclaimer

Back

Disclaimer (content)

We make reasonable efforts to keep this site accurate and up to date, but provide the content “as is” without warranties of any kind.

External links

This website may contain links to external websites. We have no control over their content and therefore accept no responsibility for them.

Copyright

Unless otherwise stated, content on this site is subject to applicable copyright laws. Third‑party content is marked where possible.

Security & usage notice

Phoenix provides hints about potential security issues. Findings should be verified in context. Even with careful development, false positives and false negatives may occur. Use at your own risk.