Hi Sebastian, Marc, Björn & list, Marc Delisle schrieb: I think, that this is a good idea. Scanners like Chorizo are helpful, but unfortunately people who want to hack a php application are able to use them too. This is why we probably should know about vulnerabilities those scanners will find. The mayflower guys showed me Chorizo a couple of times at the php conferences and it looked pretty good. I haven't used it myself yet, though. Scanning phpMyAdmin once with the full version of Chorizo would be a good thing to do - as long as Björn waits with the publication of his case study/press release until the vulnerabilities found have been fixed. And if you would need some additional manpower for the fixing, I'll be at your service. :-) But as the development goes on, it is likely, that new vulnerabilities find their way into phpMyAdmin. So, some agreement that allows the team to at least scan betas and RCs of planned major releases would be way more helpful, imho. Unfortunately, a Chorizo license is unaffordable for open source projects like phpMyAdmin, that don't have a big company in the background. :-/ Anyway, there is also a free version. Let's give that one a try. Regards, Alexander