Security

Less moving parts, less to break

This is not a fortress by slogan. It is a small surface: PHP files, no SQL, no user accounts, no admin CMS.

• No database — there is no SQL injection path in the framework.
• Escaped views — print dynamic text with e().
• Private folders — Apache forbids /app and /core.
• Strict URL segments — only letters, numbers, hyphen, underscore. /about.php is a 404.
• Forms — honeypot field; JSON endpoint; configure a real mailbox.
• You still keep PHP updated on the host, use HTTPS, and set debug to false in production.

That combination is usually enough for a brochure or mini-business site. It is not a bank. Do not store card data here.