A drop-in production runtime for your existing app. Same code, no rewrite, no framework — the dangerous parts just stop failing silently.
CorePHP guards your app at two moments, so nothing silent ever reaches production.
Scans your existing code and reports every SAFE / SECURE / STABLE risk — unchecked
json_decode, unserialize, request-scoped state that leaks in a
long-running worker — with file, line, and fix. Framework-aware.
Turns whatever slips through into a proper exception, contains memory leaks by recycling workers, and keeps one bad request from taking down the pool. Zero cold starts.
Three guarantees, enforced underneath your app — not bolted on top of it.
Pure-PHP safe replacements (s_json, s_file, …) throw standard
exceptions instead of returning null/false, and the boot error
handler turns warnings into exceptions. Fatals become catchable, logged, and traced.
unserialize, eval, exec, system
disabled at the engine level. Hardened php.ini. Fully auditable — no black boxes.
Persistent, supervised workers with automatic recycling. Per-request isolation. Memory leaks contained instead of accumulating. No cold starts.
Open-source and community-first. Milestones ship when they're ready; each quarter has one clear job.
/health → 200).s_*() proven byte-identical to native PHP on valid input, enforced in CI.docker pull greicodex/corephp-vm:1.0.0.--json + CI exit code. Flags the demo's silent-failure lines before deploy.