Security: pphatdev/pxp-cli

Security

SECURITY.md

Security Policy

Supported Versions

We release patches for security vulnerabilities in the following versions:

VersionSupported
1.3.x✅
1.2.x✅
1.1.x❌
1.0.x❌
< 1.0❌

Reporting a Vulnerability

We take the security of pxp-cli seriously. If you believe you have found a security vulnerability, please report it to us as described below.

Please DO NOT:

  • Open a public GitHub issue for the vulnerability
  • Disclose the vulnerability publicly before it has been addressed

Please DO:

  1. Email us directly at [INSERT SECURITY EMAIL HERE] with:

    • Description of the vulnerability
    • Steps to reproduce the issue
    • Potential impact
    • Any suggested fixes (if you have them)

  2. Include the following information (if applicable):

    • Type of vulnerability (e.g., code execution, privilege escalation, etc.)
    • Full paths of source file(s) related to the vulnerability
    • Location of the affected source code (tag/branch/commit)
    • Any special configuration required to reproduce the issue
    • Step-by-step instructions to reproduce the issue
    • Proof-of-concept or exploit code (if possible)
    • Impact of the issue, including how an attacker might exploit it

What to Expect:

  • Acknowledgment: We will acknowledge receipt of your report within 48 hours
  • Assessment: We will investigate and assess the vulnerability
  • Updates: We will keep you informed of our progress
  • Resolution: Once resolved, we will:
    • Release a security patch
    • Credit you in the security advisory (unless you prefer to remain anonymous)
    • Publish a security advisory

Timeline:

  • 48 hours: Initial response and acknowledgment
  • 7 days: Preliminary assessment and severity rating
  • 30 days: Target for releasing a fix (depending on complexity)

Security Best Practices

When using pxp-cli:

1. Run with Appropriate Permissions

  • Only run pxp commands as Administrator when necessary
  • Don't grant unnecessary elevated permissions

2. Verify Downloads

  • Only download pxp from official sources:
  • Verify installer signatures when available

3. Keep Software Updated

  • Use the latest version of pxp-cli
  • Keep Windows and PowerShell updated
  • Keep XAMPP and PHP updated

4. Review Configuration Changes

  • Check Apache configuration changes made by pxp
  • Review httpd-xampp.conf periodically
  • Keep backups of your configurations

5. Secure Your PHP Environment

  • Use appropriate php.ini security settings
  • Disable unnecessary PHP extensions
  • Keep PHP versions updated with security patches

6. Monitor Logs

  • Regularly check Apache error logs
  • Monitor for unusual activity
  • Review system logs

Known Security Considerations

PowerShell Execution Policy

pxp bypasses PowerShell execution policy to run scripts. This is necessary for the tool to function but means:

  • Scripts can execute without signature verification
  • Only download pxp from trusted sources
  • Verify the integrity of scripts before running

Administrator Privileges

pxp requires administrator privileges to:

  • Modify XAMPP directory structure
  • Update Apache configuration
  • Restart Apache service

This is necessary for the tool's functionality. Always:

  • Run from a trusted terminal
  • Review changes made by the tool
  • Keep backups

File System Operations

pxp performs file system operations including:

  • Renaming PHP directories
  • Modifying configuration files
  • Downloading and extracting archives

Risks are mitigated by:

  • Backup creation before changes
  • Validation before operations
  • Safe error handling

Security Updates

Security updates will be released as soon as possible after a vulnerability is confirmed. Updates will be:

  • Published as new releases on GitHub
  • Documented in the CHANGELOG
  • Announced via:
    • GitHub Security Advisory
    • Release notes
    • README updates

Attribution

We believe in responsible disclosure and will credit security researchers who report vulnerabilities to us (unless they prefer to remain anonymous).

Questions?

If you have questions about this security policy, please open a GitHub issue with the label "security-question" or contact us via email.

References

Last Updated: February 26, 2026

There aren't any published security advisories

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Security: pphatdev/pxp-cli
Security

SECURITY.md

Security Policy
Supported Versions
We release patches for security vulnerabilities in the following versions:
VersionSupported
1.3.x✅
1.2.x✅
1.1.x❌
1.0.x❌
< 1.0❌
Reporting a Vulnerability
We take the security of pxp-cli seriously. If you believe you have found a security vulnerability, please report it to us as described below.
Please DO NOT:
  • Open a public GitHub issue for the vulnerability
  • Disclose the vulnerability publicly before it has been addressed
Please DO:
  1. Email us directly at [INSERT SECURITY EMAIL HERE] with:
    • Description of the vulnerability
    • Steps to reproduce the issue
    • Potential impact
    • Any suggested fixes (if you have them)
  2. Include the following information (if applicable):
    • Type of vulnerability (e.g., code execution, privilege escalation, etc.)
    • Full paths of source file(s) related to the vulnerability
    • Location of the affected source code (tag/branch/commit)
    • Any special configuration required to reproduce the issue
    • Step-by-step instructions to reproduce the issue
    • Proof-of-concept or exploit code (if possible)
    • Impact of the issue, including how an attacker might exploit it
What to Expect:
  • Acknowledgment: We will acknowledge receipt of your report within 48 hours
  • Assessment: We will investigate and assess the vulnerability
  • Updates: We will keep you informed of our progress
  • Resolution: Once resolved, we will:

    • Release a security patch
    • Credit you in the security advisory (unless you prefer to remain anonymous)
    • Publish a security advisory
Timeline:
  • 48 hours: Initial response and acknowledgment
  • 7 days: Preliminary assessment and severity rating
  • 30 days: Target for releasing a fix (depending on complexity)
Security Best Practices
When using pxp-cli:
1. Run with Appropriate Permissions
  • Only run pxp commands as Administrator when necessary
  • Don't grant unnecessary elevated permissions
2. Verify Downloads
  • Only download pxp from official sources:

  • Verify installer signatures when available
3. Keep Software Updated
  • Use the latest version of pxp-cli
  • Keep Windows and PowerShell updated
  • Keep XAMPP and PHP updated
4. Review Configuration Changes
  • Check Apache configuration changes made by pxp
  • Review httpd-xampp.conf periodically
  • Keep backups of your configurations
5. Secure Your PHP Environment
  • Use appropriate php.ini security settings
  • Disable unnecessary PHP extensions
  • Keep PHP versions updated with security patches
6. Monitor Logs
  • Regularly check Apache error logs
  • Monitor for unusual activity
  • Review system logs
Known Security Considerations
PowerShell Execution Policy
pxp bypasses PowerShell execution policy to run scripts. This is necessary for the tool to function but means:
  • Scripts can execute without signature verification
  • Only download pxp from trusted sources
  • Verify the integrity of scripts before running
Administrator Privileges
pxp requires administrator privileges to:
  • Modify XAMPP directory structure
  • Update Apache configuration
  • Restart Apache service
This is necessary for the tool's functionality. Always:
  • Run from a trusted terminal
  • Review changes made by the tool
  • Keep backups
File System Operations
pxp performs file system operations including:
  • Renaming PHP directories
  • Modifying configuration files
  • Downloading and extracting archives
Risks are mitigated by:
  • Backup creation before changes
  • Validation before operations
  • Safe error handling
Security Updates
Security updates will be released as soon as possible after a vulnerability is confirmed. Updates will be:
  • Published as new releases on GitHub
  • Documented in the CHANGELOG
  • Announced via:

    • GitHub Security Advisory
    • Release notes
    • README updates
Attribution
We believe in responsible disclosure and will credit security researchers who report vulnerabilities to us (unless they prefer to remain anonymous).
Questions?
If you have questions about this security policy, please open a GitHub issue with the label "security-question" or contact us via email.
References
Last Updated: February 26, 2026
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: pphatdev/pxp-cli
Security

SECURITY.md

Security Policy
Supported Versions
We release patches for security vulnerabilities in the following versions:
VersionSupported
1.3.x✅
1.2.x✅
1.1.x❌
1.0.x❌
< 1.0❌
Reporting a Vulnerability
We take the security of pxp-cli seriously. If you believe you have found a security vulnerability, please report it to us as described below.
Please DO NOT:
  • Open a public GitHub issue for the vulnerability
  • Disclose the vulnerability publicly before it has been addressed
Please DO:
  1. Email us directly at [INSERT SECURITY EMAIL HERE] with:
    • Description of the vulnerability
    • Steps to reproduce the issue
    • Potential impact
    • Any suggested fixes (if you have them)
  2. Include the following information (if applicable):
    • Type of vulnerability (e.g., code execution, privilege escalation, etc.)
    • Full paths of source file(s) related to the vulnerability
    • Location of the affected source code (tag/branch/commit)
    • Any special configuration required to reproduce the issue
    • Step-by-step instructions to reproduce the issue
    • Proof-of-concept or exploit code (if possible)
    • Impact of the issue, including how an attacker might exploit it
What to Expect:
  • Acknowledgment: We will acknowledge receipt of your report within 48 hours
  • Assessment: We will investigate and assess the vulnerability
  • Updates: We will keep you informed of our progress
  • Resolution: Once resolved, we will:

    • Release a security patch
    • Credit you in the security advisory (unless you prefer to remain anonymous)
    • Publish a security advisory
Timeline:
  • 48 hours: Initial response and acknowledgment
  • 7 days: Preliminary assessment and severity rating
  • 30 days: Target for releasing a fix (depending on complexity)
Security Best Practices
When using pxp-cli:
1. Run with Appropriate Permissions
  • Only run pxp commands as Administrator when necessary
  • Don't grant unnecessary elevated permissions
2. Verify Downloads
  • Only download pxp from official sources:

  • Verify installer signatures when available
3. Keep Software Updated
  • Use the latest version of pxp-cli
  • Keep Windows and PowerShell updated
  • Keep XAMPP and PHP updated
4. Review Configuration Changes
  • Check Apache configuration changes made by pxp
  • Review httpd-xampp.conf periodically
  • Keep backups of your configurations
5. Secure Your PHP Environment
  • Use appropriate php.ini security settings
  • Disable unnecessary PHP extensions
  • Keep PHP versions updated with security patches
6. Monitor Logs
  • Regularly check Apache error logs
  • Monitor for unusual activity
  • Review system logs
Known Security Considerations
PowerShell Execution Policy
pxp bypasses PowerShell execution policy to run scripts. This is necessary for the tool to function but means:
  • Scripts can execute without signature verification
  • Only download pxp from trusted sources
  • Verify the integrity of scripts before running
Administrator Privileges
pxp requires administrator privileges to:
  • Modify XAMPP directory structure
  • Update Apache configuration
  • Restart Apache service
This is necessary for the tool's functionality. Always:
  • Run from a trusted terminal
  • Review changes made by the tool
  • Keep backups
File System Operations
pxp performs file system operations including:
  • Renaming PHP directories
  • Modifying configuration files
  • Downloading and extracting archives
Risks are mitigated by:
  • Backup creation before changes
  • Validation before operations
  • Safe error handling
Security Updates
Security updates will be released as soon as possible after a vulnerability is confirmed. Updates will be:
  • Published as new releases on GitHub
  • Documented in the CHANGELOG
  • Announced via:

    • GitHub Security Advisory
    • Release notes
    • README updates
Attribution
We believe in responsible disclosure and will credit security researchers who report vulnerabilities to us (unless they prefer to remain anonymous).
Questions?
If you have questions about this security policy, please open a GitHub issue with the label "security-question" or contact us via email.
References
Last Updated: February 26, 2026
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: pphatdev/pxp-cli
Security

SECURITY.md

Security Policy
Supported Versions
We release patches for security vulnerabilities in the following versions:
VersionSupported
1.3.x✅
1.2.x✅
1.1.x❌
1.0.x❌
< 1.0❌
Reporting a Vulnerability
We take the security of pxp-cli seriously. If you believe you have found a security vulnerability, please report it to us as described below.
Please DO NOT:
  • Open a public GitHub issue for the vulnerability
  • Disclose the vulnerability publicly before it has been addressed
Please DO:
  1. Email us directly at [INSERT SECURITY EMAIL HERE] with:
    • Description of the vulnerability
    • Steps to reproduce the issue
    • Potential impact
    • Any suggested fixes (if you have them)
  2. Include the following information (if applicable):
    • Type of vulnerability (e.g., code execution, privilege escalation, etc.)
    • Full paths of source file(s) related to the vulnerability
    • Location of the affected source code (tag/branch/commit)
    • Any special configuration required to reproduce the issue
    • Step-by-step instructions to reproduce the issue
    • Proof-of-concept or exploit code (if possible)
    • Impact of the issue, including how an attacker might exploit it
What to Expect:
  • Acknowledgment: We will acknowledge receipt of your report within 48 hours
  • Assessment: We will investigate and assess the vulnerability
  • Updates: We will keep you informed of our progress
  • Resolution: Once resolved, we will:

    • Release a security patch
    • Credit you in the security advisory (unless you prefer to remain anonymous)
    • Publish a security advisory
Timeline:
  • 48 hours: Initial response and acknowledgment
  • 7 days: Preliminary assessment and severity rating
  • 30 days: Target for releasing a fix (depending on complexity)
Security Best Practices
When using pxp-cli:
1. Run with Appropriate Permissions
  • Only run pxp commands as Administrator when necessary
  • Don't grant unnecessary elevated permissions
2. Verify Downloads
  • Only download pxp from official sources:

  • Verify installer signatures when available
3. Keep Software Updated
  • Use the latest version of pxp-cli
  • Keep Windows and PowerShell updated
  • Keep XAMPP and PHP updated
4. Review Configuration Changes
  • Check Apache configuration changes made by pxp
  • Review httpd-xampp.conf periodically
  • Keep backups of your configurations
5. Secure Your PHP Environment
  • Use appropriate php.ini security settings
  • Disable unnecessary PHP extensions
  • Keep PHP versions updated with security patches
6. Monitor Logs
  • Regularly check Apache error logs
  • Monitor for unusual activity
  • Review system logs
Known Security Considerations
PowerShell Execution Policy
pxp bypasses PowerShell execution policy to run scripts. This is necessary for the tool to function but means:
  • Scripts can execute without signature verification
  • Only download pxp from trusted sources
  • Verify the integrity of scripts before running
Administrator Privileges
pxp requires administrator privileges to:
  • Modify XAMPP directory structure
  • Update Apache configuration
  • Restart Apache service
This is necessary for the tool's functionality. Always:
  • Run from a trusted terminal
  • Review changes made by the tool
  • Keep backups
File System Operations
pxp performs file system operations including:
  • Renaming PHP directories
  • Modifying configuration files
  • Downloading and extracting archives
Risks are mitigated by:
  • Backup creation before changes
  • Validation before operations
  • Safe error handling
Security Updates
Security updates will be released as soon as possible after a vulnerability is confirmed. Updates will be:
  • Published as new releases on GitHub
  • Documented in the CHANGELOG
  • Announced via:

    • GitHub Security Advisory
    • Release notes
    • README updates
Attribution
We believe in responsible disclosure and will credit security researchers who report vulnerabilities to us (unless they prefer to remain anonymous).
Questions?
If you have questions about this security policy, please open a GitHub issue with the label "security-question" or contact us via email.
References
Last Updated: February 26, 2026
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Security: pphatdev/pxp-cli
Security

SECURITY.md

Security Policy
Supported Versions
We release patches for security vulnerabilities in the following versions:
VersionSupported
1.3.x✅
1.2.x✅
1.1.x❌
1.0.x❌
< 1.0❌
Reporting a Vulnerability
We take the security of pxp-cli seriously. If you believe you have found a security vulnerability, please report it to us as described below.
Please DO NOT:
  • Open a public GitHub issue for the vulnerability
  • Disclose the vulnerability publicly before it has been addressed
Please DO:
  1. Email us directly at [INSERT SECURITY EMAIL HERE] with:
    • Description of the vulnerability
    • Steps to reproduce the issue
    • Potential impact
    • Any suggested fixes (if you have them)
  2. Include the following information (if applicable):
    • Type of vulnerability (e.g., code execution, privilege escalation, etc.)
    • Full paths of source file(s) related to the vulnerability
    • Location of the affected source code (tag/branch/commit)
    • Any special configuration required to reproduce the issue
    • Step-by-step instructions to reproduce the issue
    • Proof-of-concept or exploit code (if possible)
    • Impact of the issue, including how an attacker might exploit it
What to Expect:
  • Acknowledgment: We will acknowledge receipt of your report within 48 hours
  • Assessment: We will investigate and assess the vulnerability
  • Updates: We will keep you informed of our progress
  • Resolution: Once resolved, we will:

    • Release a security patch
    • Credit you in the security advisory (unless you prefer to remain anonymous)
    • Publish a security advisory
Timeline:
  • 48 hours: Initial response and acknowledgment
  • 7 days: Preliminary assessment and severity rating
  • 30 days: Target for releasing a fix (depending on complexity)
Security Best Practices
When using pxp-cli:
1. Run with Appropriate Permissions
  • Only run pxp commands as Administrator when necessary
  • Don't grant unnecessary elevated permissions
2. Verify Downloads
  • Only download pxp from official sources:

  • Verify installer signatures when available
3. Keep Software Updated
  • Use the latest version of pxp-cli
  • Keep Windows and PowerShell updated
  • Keep XAMPP and PHP updated
4. Review Configuration Changes
  • Check Apache configuration changes made by pxp
  • Review httpd-xampp.conf periodically
  • Keep backups of your configurations
5. Secure Your PHP Environment
  • Use appropriate php.ini security settings
  • Disable unnecessary PHP extensions
  • Keep PHP versions updated with security patches
6. Monitor Logs
  • Regularly check Apache error logs
  • Monitor for unusual activity
  • Review system logs
Known Security Considerations
PowerShell Execution Policy
pxp bypasses PowerShell execution policy to run scripts. This is necessary for the tool to function but means:
  • Scripts can execute without signature verification
  • Only download pxp from trusted sources
  • Verify the integrity of scripts before running
Administrator Privileges
pxp requires administrator privileges to:
  • Modify XAMPP directory structure
  • Update Apache configuration
  • Restart Apache service
This is necessary for the tool's functionality. Always:
  • Run from a trusted terminal
  • Review changes made by the tool
  • Keep backups
File System Operations
pxp performs file system operations including:
  • Renaming PHP directories
  • Modifying configuration files
  • Downloading and extracting archives
Risks are mitigated by:
  • Backup creation before changes
  • Validation before operations
  • Safe error handling
Security Updates
Security updates will be released as soon as possible after a vulnerability is confirmed. Updates will be:
  • Published as new releases on GitHub
  • Documented in the CHANGELOG
  • Announced via:

    • GitHub Security Advisory
    • Release notes
    • README updates
Attribution
We believe in responsible disclosure and will credit security researchers who report vulnerabilities to us (unless they prefer to remain anonymous).
Questions?
If you have questions about this security policy, please open a GitHub issue with the label "security-question" or contact us via email.
References
Last Updated: February 26, 2026
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: pphatdev/pxp-cli
Security

SECURITY.md

Security Policy
Supported Versions
We release patches for security vulnerabilities in the following versions:
VersionSupported
1.3.x✅
1.2.x✅
1.1.x❌
1.0.x❌
< 1.0❌
Reporting a Vulnerability
We take the security of pxp-cli seriously. If you believe you have found a security vulnerability, please report it to us as described below.
Please DO NOT:
  • Open a public GitHub issue for the vulnerability
  • Disclose the vulnerability publicly before it has been addressed
Please DO:
  1. Email us directly at [INSERT SECURITY EMAIL HERE] with:
    • Description of the vulnerability
    • Steps to reproduce the issue
    • Potential impact
    • Any suggested fixes (if you have them)
  2. Include the following information (if applicable):
    • Type of vulnerability (e.g., code execution, privilege escalation, etc.)
    • Full paths of source file(s) related to the vulnerability
    • Location of the affected source code (tag/branch/commit)
    • Any special configuration required to reproduce the issue
    • Step-by-step instructions to reproduce the issue
    • Proof-of-concept or exploit code (if possible)
    • Impact of the issue, including how an attacker might exploit it
What to Expect:
  • Acknowledgment: We will acknowledge receipt of your report within 48 hours
  • Assessment: We will investigate and assess the vulnerability
  • Updates: We will keep you informed of our progress
  • Resolution: Once resolved, we will:

    • Release a security patch
    • Credit you in the security advisory (unless you prefer to remain anonymous)
    • Publish a security advisory
Timeline:
  • 48 hours: Initial response and acknowledgment
  • 7 days: Preliminary assessment and severity rating
  • 30 days: Target for releasing a fix (depending on complexity)
Security Best Practices
When using pxp-cli:
1. Run with Appropriate Permissions
  • Only run pxp commands as Administrator when necessary
  • Don't grant unnecessary elevated permissions
2. Verify Downloads
  • Only download pxp from official sources:

  • Verify installer signatures when available
3. Keep Software Updated
  • Use the latest version of pxp-cli
  • Keep Windows and PowerShell updated
  • Keep XAMPP and PHP updated
4. Review Configuration Changes
  • Check Apache configuration changes made by pxp
  • Review httpd-xampp.conf periodically
  • Keep backups of your configurations
5. Secure Your PHP Environment
  • Use appropriate php.ini security settings
  • Disable unnecessary PHP extensions
  • Keep PHP versions updated with security patches
6. Monitor Logs
  • Regularly check Apache error logs
  • Monitor for unusual activity
  • Review system logs
Known Security Considerations
PowerShell Execution Policy
pxp bypasses PowerShell execution policy to run scripts. This is necessary for the tool to function but means:
  • Scripts can execute without signature verification
  • Only download pxp from trusted sources
  • Verify the integrity of scripts before running
Administrator Privileges
pxp requires administrator privileges to:
  • Modify XAMPP directory structure
  • Update Apache configuration
  • Restart Apache service
This is necessary for the tool's functionality. Always:
  • Run from a trusted terminal
  • Review changes made by the tool
  • Keep backups
File System Operations
pxp performs file system operations including:
  • Renaming PHP directories
  • Modifying configuration files
  • Downloading and extracting archives
Risks are mitigated by:
  • Backup creation before changes
  • Validation before operations
  • Safe error handling
Security Updates
Security updates will be released as soon as possible after a vulnerability is confirmed. Updates will be:
  • Published as new releases on GitHub
  • Documented in the CHANGELOG
  • Announced via:

    • GitHub Security Advisory
    • Release notes
    • README updates
Attribution
We believe in responsible disclosure and will credit security researchers who report vulnerabilities to us (unless they prefer to remain anonymous).
Questions?
If you have questions about this security policy, please open a GitHub issue with the label "security-question" or contact us via email.
References
Last Updated: February 26, 2026
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: pphatdev/pxp-cli
Security

SECURITY.md

Security Policy
Supported Versions
We release patches for security vulnerabilities in the following versions:
VersionSupported
1.3.x✅
1.2.x✅
1.1.x❌
1.0.x❌
< 1.0❌
Reporting a Vulnerability
We take the security of pxp-cli seriously. If you believe you have found a security vulnerability, please report it to us as described below.
Please DO NOT:
  • Open a public GitHub issue for the vulnerability
  • Disclose the vulnerability publicly before it has been addressed
Please DO:
  1. Email us directly at [INSERT SECURITY EMAIL HERE] with:
    • Description of the vulnerability
    • Steps to reproduce the issue
    • Potential impact
    • Any suggested fixes (if you have them)
  2. Include the following information (if applicable):
    • Type of vulnerability (e.g., code execution, privilege escalation, etc.)
    • Full paths of source file(s) related to the vulnerability
    • Location of the affected source code (tag/branch/commit)
    • Any special configuration required to reproduce the issue
    • Step-by-step instructions to reproduce the issue
    • Proof-of-concept or exploit code (if possible)
    • Impact of the issue, including how an attacker might exploit it
What to Expect:
  • Acknowledgment: We will acknowledge receipt of your report within 48 hours
  • Assessment: We will investigate and assess the vulnerability
  • Updates: We will keep you informed of our progress
  • Resolution: Once resolved, we will:

    • Release a security patch
    • Credit you in the security advisory (unless you prefer to remain anonymous)
    • Publish a security advisory
Timeline:
  • 48 hours: Initial response and acknowledgment
  • 7 days: Preliminary assessment and severity rating
  • 30 days: Target for releasing a fix (depending on complexity)
Security Best Practices
When using pxp-cli:
1. Run with Appropriate Permissions
  • Only run pxp commands as Administrator when necessary
  • Don't grant unnecessary elevated permissions
2. Verify Downloads
  • Only download pxp from official sources:

  • Verify installer signatures when available
3. Keep Software Updated
  • Use the latest version of pxp-cli
  • Keep Windows and PowerShell updated
  • Keep XAMPP and PHP updated
4. Review Configuration Changes
  • Check Apache configuration changes made by pxp
  • Review httpd-xampp.conf periodically
  • Keep backups of your configurations
5. Secure Your PHP Environment
  • Use appropriate php.ini security settings
  • Disable unnecessary PHP extensions
  • Keep PHP versions updated with security patches
6. Monitor Logs
  • Regularly check Apache error logs
  • Monitor for unusual activity
  • Review system logs
Known Security Considerations
PowerShell Execution Policy
pxp bypasses PowerShell execution policy to run scripts. This is necessary for the tool to function but means:
  • Scripts can execute without signature verification
  • Only download pxp from trusted sources
  • Verify the integrity of scripts before running
Administrator Privileges
pxp requires administrator privileges to:
  • Modify XAMPP directory structure
  • Update Apache configuration
  • Restart Apache service
This is necessary for the tool's functionality. Always:
  • Run from a trusted terminal
  • Review changes made by the tool
  • Keep backups
File System Operations
pxp performs file system operations including:
  • Renaming PHP directories
  • Modifying configuration files
  • Downloading and extracting archives
Risks are mitigated by:
  • Backup creation before changes
  • Validation before operations
  • Safe error handling
Security Updates
Security updates will be released as soon as possible after a vulnerability is confirmed. Updates will be:
  • Published as new releases on GitHub
  • Documented in the CHANGELOG
  • Announced via:

    • GitHub Security Advisory
    • Release notes
    • README updates
Attribution
We believe in responsible disclosure and will credit security researchers who report vulnerabilities to us (unless they prefer to remain anonymous).
Questions?
If you have questions about this security policy, please open a GitHub issue with the label "security-question" or contact us via email.
References
Last Updated: February 26, 2026
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Security: pphatdev/pxp-cli
Security

SECURITY.md

Security Policy
Supported Versions
We release patches for security vulnerabilities in the following versions:
VersionSupported
1.3.x✅
1.2.x✅
1.1.x❌
1.0.x❌
< 1.0❌
Reporting a Vulnerability
We take the security of pxp-cli seriously. If you believe you have found a security vulnerability, please report it to us as described below.
Please DO NOT:
  • Open a public GitHub issue for the vulnerability
  • Disclose the vulnerability publicly before it has been addressed
Please DO:
  1. Email us directly at [INSERT SECURITY EMAIL HERE] with:
    • Description of the vulnerability
    • Steps to reproduce the issue
    • Potential impact
    • Any suggested fixes (if you have them)
  2. Include the following information (if applicable):
    • Type of vulnerability (e.g., code execution, privilege escalation, etc.)
    • Full paths of source file(s) related to the vulnerability
    • Location of the affected source code (tag/branch/commit)
    • Any special configuration required to reproduce the issue
    • Step-by-step instructions to reproduce the issue
    • Proof-of-concept or exploit code (if possible)
    • Impact of the issue, including how an attacker might exploit it
What to Expect:
  • Acknowledgment: We will acknowledge receipt of your report within 48 hours
  • Assessment: We will investigate and assess the vulnerability
  • Updates: We will keep you informed of our progress
  • Resolution: Once resolved, we will:

    • Release a security patch
    • Credit you in the security advisory (unless you prefer to remain anonymous)
    • Publish a security advisory
Timeline:
  • 48 hours: Initial response and acknowledgment
  • 7 days: Preliminary assessment and severity rating
  • 30 days: Target for releasing a fix (depending on complexity)
Security Best Practices
When using pxp-cli:
1. Run with Appropriate Permissions
  • Only run pxp commands as Administrator when necessary
  • Don't grant unnecessary elevated permissions
2. Verify Downloads
  • Only download pxp from official sources:

  • Verify installer signatures when available
3. Keep Software Updated
  • Use the latest version of pxp-cli
  • Keep Windows and PowerShell updated
  • Keep XAMPP and PHP updated
4. Review Configuration Changes
  • Check Apache configuration changes made by pxp
  • Review httpd-xampp.conf periodically
  • Keep backups of your configurations
5. Secure Your PHP Environment
  • Use appropriate php.ini security settings
  • Disable unnecessary PHP extensions
  • Keep PHP versions updated with security patches
6. Monitor Logs
  • Regularly check Apache error logs
  • Monitor for unusual activity
  • Review system logs
Known Security Considerations
PowerShell Execution Policy
pxp bypasses PowerShell execution policy to run scripts. This is necessary for the tool to function but means:
  • Scripts can execute without signature verification
  • Only download pxp from trusted sources
  • Verify the integrity of scripts before running
Administrator Privileges
pxp requires administrator privileges to:
  • Modify XAMPP directory structure
  • Update Apache configuration
  • Restart Apache service
This is necessary for the tool's functionality. Always:
  • Run from a trusted terminal
  • Review changes made by the tool
  • Keep backups
File System Operations
pxp performs file system operations including:
  • Renaming PHP directories
  • Modifying configuration files
  • Downloading and extracting archives
Risks are mitigated by:
  • Backup creation before changes
  • Validation before operations
  • Safe error handling
Security Updates
Security updates will be released as soon as possible after a vulnerability is confirmed. Updates will be:
  • Published as new releases on GitHub
  • Documented in the CHANGELOG
  • Announced via:

    • GitHub Security Advisory
    • Release notes
    • README updates
Attribution
We believe in responsible disclosure and will credit security researchers who report vulnerabilities to us (unless they prefer to remain anonymous).
Questions?
If you have questions about this security policy, please open a GitHub issue with the label "security-question" or contact us via email.
References
Last Updated: February 26, 2026
 There aren't any published security advisories