#!/usr/bin/env sh
# Basic advisory scan only; run from project root. Not a security certification.
set -eu
printf '%s\n' 'Checking PHP files for obvious risky patterns (review matches manually)...'
if command -v grep >/dev/null 2>&1; then
  grep -RInE --include='*.php' 'eval\(|\bexec\(|shell_exec\(|system\(|move_uploaded_file\(|\$_(GET|POST|REQUEST)\[' public src config || true
fi
printf '%s\n' 'Check completed. Matches can be legitimate; absence does not prove security.'