Marking a detection as a false positive could create a wider exclusion rule than intended

PKSA-grsv-gc9r-djpk

Affected version: <1.9.0

Reported by:
FriendsOfPHP/security-advisories

Attacks go unrecorded when a request carries malformed headers or oversized fields

PKSA-j8sb-5q45-xtvw

Affected version: <1.9.0

Reported by:
FriendsOfPHP/security-advisories

Credentials under prefixed or nested names stored in cleartext in the threat log

PKSA-fq5s-jjn9-17wq

Affected version: <1.9.0

Reported by:
FriendsOfPHP/security-advisories

Plaintext credentials written to the threat log and readable by any authenticated user

PKSA-1nr4-5xd6-jgjp

Affected version: <1.8.0

Reported by:
FriendsOfPHP/security-advisories