I’m not sure if anyone actually looked at the code for the PHP-based API-gateway, but as a TLDR: it’s trivially injectable to give RCEs and not really hardenede

I’m not sure if anyone actually looked at the code for the PHP-based API-gateway, but as a TLDR: it’s trivially injectable to give RCEs and not really hardeneded nor is input sanitized properly at all. I realize this is meant for deployment on a local trusted network, but I still think that’s worth putting somewhere in big bold fonts.