PHP2Shell (CVE-2026-109618, CVE-2026-109619): critical RCE, exploited in the wild. Fixed in 8.5.12 · 8.4.27 · 8.3.36 · 8.2.35. Read the advisory
Source

Read every line, nothing hidden.

Shellproof runs on your own machine and sends nothing about you anywhere — so you should be able to confirm exactly what it does. This is the real source that ships inside shellproof.pyz: the check modules, the CLI, the in-browser checkers and the build scripts. Pick a file to read it with line numbers.

This is the exact source that ships in shellproof.pyz. Each file below is the byte-for-byte copy from the repository, served as plain text. Rebuilt by scripts/build_code_browser.py. Nothing here is minified or generated.

Select a file from the list to read its source.

Want the whole thing?

Download the runnable bundle and audit it offline, or start with the README.