---
id: 10
title: check framework
status: done
priority: high
created: 2026-07-17T02:16:23.059189291+02:00
updated: 2026-07-17T12:26:07.258170416+02:00
started: 2026-07-17T12:26:07.265125164+02:00
completed: 2026-07-17T12:26:07.265125164+02:00
class: standard
---

Check if the framework is the optimal, most simple and flexible  way to go. If not: suggest some changes.

[[2026-07-17]] Fri 03:25
Framework review committed: docs/framework_review.md (commit 2f61b07). Verdict: architecture is simple/flexible (zero-config routing, autoloader, Search plugin interface, native templates) — keep as-is. Not optimal due to 3 P0 correctness bugs (Brave size/offset params never sent because setQuery builds URL before setParam; query double-URL-encoded; autoloader hardcodes ':' vs PATH_SEPARATOR), P1 config/security (ZAP_DEBUG=true & placeholder key committed, no CSRF, die() routing, unsafe reset.php, second-resolution session folder collisions), P2 consistency. NO source edits — deliverable is docs-only. Includes recommended-task table for follow-up fixes (each independently approvable). Handing to review for Fabian's approval before any code changes.