RFC 9116: security.txt for your PHP apps

… and how we automated it in CakePHP Most security incidents do not start with a genius attacker. They start with an honest person who found something and could not figure out how to tell you. If reporting a bug is harder than tweeting about it, you have quietly chosen public disclosure for them. At the same time AI makes it possible to even automate security testing on a scale we have not seen…