Security
Report a vulnerability privately so it can be assessed before public disclosure.
Report it privately
Mail security@playwright-php.dev. Do not open a public issue: an unfixed vulnerability described in public is a vulnerability handed to everyone at once.
English or French, both work.
What belongs here
This channel covers Playwright PHP itself: the library, the packages published under the playwright-php organization, and the transport between PHP and the driver.
Four things are somebody else's channel, and reporting them here only delays the fix:
- Browser vulnerabilities. Chromium, Firefox, and WebKit have their own disclosure programs.
- Upstream Playwright. The driver and protocol belong to microsoft/playwright.
- Dependencies. Report to the package that ships the flaw. Tell us too if Playwright PHP is what exposes it.
- The application you automate. A test that finds a hole in your own site is a finding about your site.
Unsure which one it is? Send it anyway. Misrouting a real vulnerability costs more than a redirect.
What to send
- the version of Playwright PHP, and of the package if it is one of the companion packages;
- your PHP version and operating system;
- the browser and Playwright driver version, when the browser is involved;
- a reduced reproduction: the smallest script that shows the problem;
- what an attacker gets out of it.
Leave credentials, tokens, and customer data out of the report. If a reproduction needs them, say so and send placeholders.
What happens next
- Acknowledgement. A human confirms the report landed as soon as practical.
- Assessment. Reproduction, impact, and which versions are affected.
- Fix. Patched as fast as the severity warrants, coordinated with you.
- Advisory. A GitHub security advisory, with credit if you want it.
- Disclosure. Public once a fixed release exists, following coordinated vulnerability disclosure.