Question 1

Why can there be false positives?

Accepted Answer

PHP is dynamic and static analysis relies on heuristics. Results should be verified during review and can be hidden via suppressions when verified.

Question 2

How do I integrate Phoenix into my workflow?

Accepted Answer

Use Phoenix before releases or during review phases. Export reports as HTML/JSON and combine findings with manual verification.

Question 3

Which vulnerabilities are detected?

Accepted Answer

Best-effort detection of common classes such as XSS, SQL injection, LFI/RFI, SSRF, XXE, deserialization, and other HTTP/OS/DB-related risks.

Imprint