# Verification — advanced release

Executed on 2026-11-03 (Asia/Dhaka).

| Check | Observed result |
|---|---|
| PHP | Isolated PHP 8.3.6 with GD |
| PHPUnit | 52 tests, 119 assertions, all passed |
| Consent decision tests | 10 Node tests, all passed |
| Dependency lock update | Successful; no package changes; GD platform requirement recorded |
| Composer advisory check | No known security advisories reported during lock update |
| Composer manifest/lock validation | Valid |
| Route and Blade view caching | Successful |
| Formatting | Laravel Pint with PSR-12 preset applied |
| Frontend build | Successful; roughly 3.2 KB CSS and 2.1 KB JS gzip, excluding framework/vendor scripts |
| Database migration + seed | Successful on disposable SQLite under production APP_ENV |
| Local application benchmark | 90 sequential HTTP-kernel requests; see BENCHMARK.json |

Security coverage includes owner-only settings, password confirmation, invalid tracking IDs, protected roles, real TOTP authentication, session-bound encrypted results, active-role revocation, unknown processor rejection, pipeline output bounds, no template execution, local-only redirects/loop rejection, meta escaping, PNG rewriting and SVG rejection, legal publication guards, private/signed-in tracking suppression, production HTTPS redirection and CSRF rejection. Reseeding preserves edited content and permissions.

Consent tests cover default denial, missing CMP/TCF signals, Google vendor/purpose decisions, DNT/GPC, marketing withdrawal and disabled CMP. These are automated decision tests, not confirmation of the behavior of a live third-party script.

## Benchmark interpretation

The recorded warm p95 timings were approximately 7.2 ms for the homepage, 5.0 ms for a tool page and 4.0 ms for the guide index. The initial homepage request was approximately 128 ms. Method: in-process Laravel HTTP kernel; APP_ENV=production; APP_DEBUG=false; disposable SQLite; array sessions/cache; one process, sequential requests, no real network, TLS, CDN, browser or concurrent visitors. These figures are **not production TTFB, a load-test result or a Lighthouse score**. Use them only as a local application baseline.

## Not verified

No public deployment, real-browser visual/accessibility test, live CMP/AdSense/GA4/Pixel request audit, MySQL/Redis/Horizon integration test, SMTP/Sentry delivery, ClamAV/GeoIP integration, WAF/TLS test, backup restore, independent penetration test, concurrent load test or Lighthouse run was completed. Those require target infrastructure and/or account details. No approval, legal compliance or immunity from attacks is claimed.