That looks really cool - I haven't seen it before, thanks! The "offending system" I mentioned, however, is our old PHP application that I don't really work on.

That looks really cool - I haven't seen it before, thanks! The "offending system" I mentioned, however, is our old PHP application that I don't really work on. (I mainly develop much more modern Rails stuff!) Like I said, the primary concern of the company is simply to keep pen testers happy - and their criteria for a "secure" website is, in my opinion, often misleading or even downright wrong. But if I ever get the chance to genuinely improve the system, I'll definitely look into using this.