Skip to main content
Version: v0.19

Contributing to Development

Contributions can improve detection accuracy, documentation, platform support, tests, and developer experience.

Report a bug​

Search existing issues before opening a new report. Include:

  1. Scanner version and PHP version
  2. Command used, with credentials and private paths removed
  3. Expected and actual behavior
  4. Small reproduction steps
  5. Relevant report output with sensitive code removed

Open an issue

Report a suspicious finding​

In the WordPress plugin, open the finding and select Report finding. The plugin prepares an issue with signature metadata, scanner versions, and the file SHA-256. It excludes the local file path and matched code.

For CLI installations, report the scanner version, file SHA-256, detected signature names, and observed behavior.

Do not publish executable malware

Do not paste malicious code or upload an executable sample to a public issue. A maintainer can arrange a private transfer after reviewing the metadata.

Submit code​

Fork the repository, create a focused branch, and install development dependencies:

git clone https://github.com/your-account/PHP-Antimalware-Scanner.git
cd PHP-Antimalware-Scanner
composer install
composer test

Keep each pull request focused on one problem. Explain the user impact and list the checks you ran.

Improve a translation​

The documentation supports English, Italian, German, French, Spanish, Russian, Simplified Chinese, Japanese, Hindi, and Arabic. English is the source language.

Translated pages live under docs/i18n/<locale>/docusaurus-plugin-content-docs/current/. Keep commands, option names, file paths, code, and product names unchanged. Translate the surrounding explanation in clear technical language.

When the interface gains a new label, refresh its translation catalog from the docs directory:

corepack yarn write-translations --locale it

Replace it with the locale being updated. Run corepack yarn build --locale <locale> before opening a pull request. Arabic pages must preserve right-to-left prose while paths, hashes, code, and command examples remain left-to-right.

Detection changes need an inert malicious fixture, a positive test, and a representative clean fixture or negative test. The test samples must not contain an executable malicious payload.

Read the testing guide before changing matching, signatures, exploits, dangerous functions, or deobfuscation.