Security

• No shell, ever. Commands are executed via proc_open with an argv array.
• Command whitelist. Module scripts must match modules_v4/<module>/cli/<script>.php, exist, and resolve inside a modules_v4/<module>/cli/ directory. Core commands are limited to the read-only/export allowlist.
• Argument validation. Every argument token must be a plain option or value — no shell metacharacters, no spaces inside tokens, max 10 tokens.
• Working directories. Module scripts run from the webtrees root; core commands run from data/.
• No sensitive data in stdout. The tick echoes summary lines only; full output stays in the admin-only run history.
• UI actions are all named *Admin* (admin-only, CSRF-protected).
• Kill switch: disable the module — the tick then does nothing.
• The tick is single-instance (flock), and a job’s child process is hard-killed after its timeout (SIGKILL).
• Event-queue coalescing. A flood of identical events cannot amplify into one job run per queued row.
• Webhook token header-only. Send the token exclusively in the X-Cronjob-Token header.