@anonympins/fingerprint 0.7.2 → 0.7.3

package/src/php/FingerprintEngine.php

@@ -127,41 +127,27 @@
          $useAsymmetric = ($securityConfig['useAsymmetricTickets'] ?? false) === true || ($securityConfig['ed25519'] ?? '') === 'auto';
          $envPrivate = Env::get('ED25519_PRIVATE_KEY');
          if ($useAsymmetric && ($envPrivate === null || $envPrivate === '')) {
-             $configDir = dirname(__DIR__, 1) . '/config';
-             $persistentKeyPath = $configDir . '/ed25519_key.json';
-
-             if (file_exists($persistentKeyPath)) {
-                 try {
-                     $keys = json_decode(file_get_contents($persistentKeyPath), true);
-                     if (isset($keys['privateKey'], $keys['publicKey'])) {
-                         Env::set('ED25519_PRIVATE_KEY', $keys['privateKey']);
-                         Env::set('ED25519_PUBLIC_KEY', $keys['publicKey']);
+             if (function_exists('get_option') && function_exists('update_option')) {
+                 // In WordPress, persist cryptographic keys in the database options table
+                 $storedKeys = get_option('fingerprint_ed25519_keys');
+                 if (is_array($storedKeys) && isset($storedKeys['privateKey'], $storedKeys['publicKey'])) {
+                     Env::set('ED25519_PRIVATE_KEY', $storedKeys['privateKey']);
+                     Env::set('ED25519_PUBLIC_KEY', $storedKeys['publicKey']);
+                 } elseif (defined('OPENSSL_KEYTYPE_ED25519')) {
+                     $pkey = openssl_pkey_new(["private_key_type" => OPENSSL_KEYTYPE_ED25519]);
+                     if ($pkey && openssl_pkey_export($pkey, $privateKeyPem)) {
+                         $details = openssl_pkey_get_details($pkey); // @phpstan-ignore-line
+                         $publicKeyPem = $details['key'] ?? ''; // @phpstan-ignore-line
+                         Env::set('ED25519_PRIVATE_KEY', $privateKeyPem);
+                         Env::set('ED25519_PUBLIC_KEY', $publicKeyPem);
+                         update_option('fingerprint_ed25519_keys', [
+                             'privateKey' => $privateKeyPem,
+                             'publicKey'  => $publicKeyPem,
+                         ], false);
                      }
-                 } catch (\Throwable $e) {
-                     error_log('[Fingerprint] Failed to load persistent Ed25519 keys: ' . $e->getMessage());
                  }
              } else {
-                 try {
-                     if (defined('OPENSSL_KEYTYPE_ED25519')) {
-                         $pkey = openssl_pkey_new(["private_key_type" => OPENSSL_KEYTYPE_ED25519]);
-                         if ($pkey && openssl_pkey_export($pkey, $privateKeyPem)) {
-                             $details = openssl_pkey_get_details($pkey); // @phpstan-ignore-line
-                             $publicKeyPem = $details['key']; // @phpstan-ignore-line
-                             Env::set('ED25519_PRIVATE_KEY', $privateKeyPem);
-                             Env::set('ED25519_PUBLIC_KEY', $publicKeyPem);
-                             // Also update $_ENV and $_SERVER for consistency
-                             if (!is_dir($configDir)) {
-                                 mkdir($configDir, 0777, true);
-                             }
-                             file_put_contents($persistentKeyPath, json_encode([
-                                 'privateKey' => $privateKeyPem,
-                                 'publicKey' => $publicKeyPem
-                             ], JSON_PRETTY_PRINT));
-                         }
-                     }
-                 } catch (\Throwable $e) {
-                     error_log('[Fingerprint] Native Ed25519 key generation failed: ' . $e->getMessage());
-                 }
+                 self::initStandaloneEd25519Keys();
              }
          }
 
@@ -175,7 +161,7 @@
                          $securityConfig = SecurityProfiles::deepMerge($securityConfig, $savedConfig);
                      }
                  } catch (\Throwable $e) {
-                     error_log("[FingerprintEngine] Failed to auto-load optimized config from {$savePath}: " . $e->getMessage());
+                     self::logError("[FingerprintEngine] Failed to auto-load optimized config from {$savePath}: " . $e->getMessage());
                  }
              }
          }
@@ -196,6 +182,49 @@
          }
      }
 
+     /**
+      * Initialise et persiste les cles Ed25519 pour les environnements PHP hors WordPress.
+      */
+     private static function initStandaloneEd25519Keys(): void
+     {
+         $configDir = dirname(__DIR__, 1) . '/config';
+         $persistentKeyPath = $configDir . '/ed25519_key.json';
+
+         if (file_exists($persistentKeyPath)) {
+             try {
+                 $keys = json_decode((string)file_get_contents($persistentKeyPath), true);
+                 if (isset($keys['privateKey'], $keys['publicKey'])) {
+                     Env::set('ED25519_PRIVATE_KEY', $keys['privateKey']);
+                     Env::set('ED25519_PUBLIC_KEY', $keys['publicKey']);
+                 }
+             } catch (\Throwable $e) {
+                 self::logError('[Fingerprint] Failed to load persistent Ed25519 keys: ' . $e->getMessage());
+             }
+         } else {
+             try {
+                 if (defined('OPENSSL_KEYTYPE_ED25519')) {
+                     $pkey = openssl_pkey_new(["private_key_type" => OPENSSL_KEYTYPE_ED25519]);
+                     if ($pkey && openssl_pkey_export($pkey, $privateKeyPem)) {
+                         $details = openssl_pkey_get_details($pkey); // @phpstan-ignore-line
+                         $publicKeyPem = $details['key'] ?? ''; // @phpstan-ignore-line
+                         Env::set('ED25519_PRIVATE_KEY', $privateKeyPem);
+                         Env::set('ED25519_PUBLIC_KEY', $publicKeyPem);
+                         if (!is_dir($configDir)) {
+                             mkdir($configDir, 0777, true);
+                         }
+                         // phpcs:ignore PluginCheck.CodeAnalysis.WriteFile.PluginDirectoryWrite -- Non-WordPress standalone environment fallback
+                         file_put_contents($persistentKeyPath, json_encode([
+                             'privateKey' => $privateKeyPem,
+                             'publicKey' => $publicKeyPem
+                         ], JSON_PRETTY_PRINT));
+                     }
+                 }
+             } catch (\Throwable $e) {
+                 self::logError('[Fingerprint] Native Ed25519 key generation failed: ' . $e->getMessage());
+             }
+         }
+     }
+
     /**
      * Applique à chaud une nouvelle configuration de sécurité (poids, seuils, etc.)
      * sans nécessiter de redémarrage.
@@ -266,7 +295,7 @@
                      }
                  }
              } catch (\Throwable $e) {
-                 error_log("[Fingerprint] Error loading whitelist file {$filename}: " . $e->getMessage());
+                 self::logError("[Fingerprint] Error loading whitelist file {$filename}: " . $e->getMessage());
              }
          }
          return $fallbackEntries;
@@ -358,7 +387,7 @@
              } else {
                  $logMessage = "[FingerprintEngine] {$message}";
                  if (!empty($data)) $logMessage .= ' ' . json_encode($data);
-                 error_log($logMessage);
+                 self::logError($logMessage);
              }
          }
      }
@@ -1554,7 +1583,7 @@
                      $isAsymmetric = true;
                  }
              } catch (\Throwable $e) {
-                 error_log('[Fingerprint] Asymmetric broadcast signing failed: ' . $e->getMessage());
+                 self::logError('[Fingerprint] Asymmetric broadcast signing failed: ' . $e->getMessage());
              }
          }
 
@@ -1575,7 +1604,8 @@
 
      private function asyncPost(string $url, array $params): void
      {
-         $parts = parse_url($url);
+         // phpcs:ignore WordPress.WP.AlternativeFunctions.parse_url_parse_url -- wp_parse_url used if available
+         $parts = function_exists('wp_parse_url') ? wp_parse_url($url) : parse_url($url);
          if ($parts === false) return;
 
          $host = $parts['host'];
@@ -1605,7 +1635,9 @@
              $out .= "Connection: Close\r\n\r\n";
              $out .= $postData;
 
+             // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fwrite -- Socket stream write
              @fwrite($fp, $out);
+             // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- Socket stream close
              @fclose($fp);
          }
      }
@@ -1732,7 +1764,7 @@
                 $b3 = ord($str[$offset++]); $b4 = ord($str[$offset++]);
                 return ($b1 << 24) | ($b2 << 16) | ($b3 << 8) | $b4;
             }
-            throw new \Exception("Unsupported integer size: " . $val);
+            throw new \Exception("Unsupported integer size: " . (int)$val);
         };
 
         if ($major === 0) {
@@ -1854,8 +1886,14 @@
                 return openssl_verify($verifyBuffer, base64_decode($anchor['signature']), $publicKey, OPENSSL_ALGO_SHA256) === 1;
             }
         } catch (\Throwable $e) {
-            error_log('[WebAuthn-Server] PHP verification failed: ' . $e->getMessage());
+            self::logError('[WebAuthn-Server] PHP verification failed: ' . $e->getMessage());
         }
         return false;
     }
+
+    private static function logError(string $message): void
+    {
+        // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- Engine diagnostic error log
+        error_log($message);
+    }
  }

package/src/php/Ja3AnomalyDetector.php

@@ -212,10 +212,12 @@ class Ja3AnomalyDetector
 
     /**
      * Correlates low-level TCP RTT with application layer latency to detect residential proxy hops.
+     * Evaluates continuous physical transit discrepancies rather than arbitrary step numbers.
+     * 
      * @param RequestContext $context
-     * @return int Suspicion score
+     * @return float Suspicion score between 0.0 and 95.0
      */
-    public static function getRttProxyScore(RequestContext $context): int
+    public static function getRttProxyScore(RequestContext $context): float
     {
         $tcpRttHeader = $context->headers['x-tcp-rtt'] ?? $context->headers['x-real-rtt'] ?? null;
         $tcpRtt = $tcpRttHeader !== null ? (int)$tcpRttHeader : null;
@@ -223,22 +225,28 @@ class Ja3AnomalyDetector
         $behaviorHeader = $context->headers['x-behavior-metrics'] ?? null;
         if ($behaviorHeader) {
             $metrics = json_decode($behaviorHeader, true);
-            if (json_last_error() === JSON_ERROR_NONE && isset($metrics['clientTimestamp'])) {
+            if (json_last_error() === JSON_ERROR_NONE && isset($metrics['clientTimestamp']) && is_numeric($metrics['clientTimestamp'])) {
                 $clientTimestamp = (int)$metrics['clientTimestamp'];
                 $appLatency = $context->requestTimestamp - $clientTimestamp;
-                if ($tcpRtt !== null && $tcpRtt > 0) {
-                    $clientToProxyDelta = $appLatency - $tcpRtt;
-                    if ($tcpRtt < 35 && $clientToProxyDelta > 150) {
-                        return 85;
-                    }
-                } else {
-                    if ($appLatency > 350) {
-                        return 40;
+
+                if ($tcpRtt !== null && $tcpRtt > 0 && $appLatency > 0) {
+                    // Marge de tolérance défensive contre le jitter réseau et le scheduling JS / Garbage Collection
+                    $jitterAllowance = 60.0;
+                    $effectiveRtt = max((float)$tcpRtt, 5.0);
+                    $tunnelDelta = $appLatency - ($tcpRtt + $jitterAllowance);
+                    $divergenceRatio = $appLatency / $effectiveRtt;
+
+                    // Condition de disjonction : liaison edge ultra-proche (< 40ms) + transit applicatif au moins 3x supérieur
+                    if ($tcpRtt <= 40 && $divergenceRatio >= 3.0 && $tunnelDelta > 0) {
+                        $scaling = 120.0;
+                        $ratioWeight = min(1.0, ($divergenceRatio - 3.0) / 5.0);
+                        $proxyScore = min(95.0, 40.0 + 55.0 * tanh($tunnelDelta / $scaling) * $ratioWeight);
+                        return round($proxyScore, 1);
                     }
                 }
             }
         }
-        return 0;
+        return 0.0;
     }
 }
 

package/src/php/Optimization/Optimization.php

@@ -17,7 +17,11 @@ class Optimization
         try {
             return random_int(0, PHP_INT_MAX - 1) / PHP_INT_MAX;
         } catch (\Exception $e) {
-            return (float)mt_rand() / (float)mt_getrandmax(); // Fallback
+            if (function_exists('wp_rand')) {
+                return (float)wp_rand(0, 1000000) / 1000000.0;
+            }
+            // phpcs:ignore WordPress.WP.AlternativeFunctions.rand_mt_rand -- Standalone fallback
+            return (float)mt_rand() / (float)mt_getrandmax();
         }
     }
 

package/src/php/Optimization/OptimizationOperators.php

@@ -44,7 +44,11 @@ class OptimizationOperators
         try {
             return random_int(0, PHP_INT_MAX - 1) / PHP_INT_MAX;
         } catch (\Exception $e) {
-            return (float)mt_rand() / (float)mt_getrandmax(); // Fallback
+            if (function_exists('wp_rand')) {
+                return (float)wp_rand(0, 1000000) / 1000000.0;
+            }
+            // phpcs:ignore WordPress.WP.AlternativeFunctions.rand_mt_rand -- Standalone fallback
+            return (float)mt_rand() / (float)mt_getrandmax();
         }
     }
 

package/src/php/Optimization/ProblemInitializers.php

@@ -12,6 +12,18 @@ class ProblemInitializers
     /** @var array<string, callable> */
     private static array $initializers = [];
 
+    private static function randomFloat(): float
+    {
+        try {
+            return (float)random_int(0, PHP_INT_MAX - 1) / (float)PHP_INT_MAX;
+        } catch (\Throwable $e) {
+            if (function_exists('wp_rand')) {
+                return (float)wp_rand(0, 1000000) / 1000000.0;
+            }
+            return 0.5;
+        }
+    }
+
     private static function initialize(): void
     {
         if (empty(self::$initializers)) {
@@ -22,8 +34,8 @@ class ProblemInitializers
                 $points = [];
                 for ($i = 0; $i < $count; $i++) {
                     $points[] = [
-                        'x' => mt_rand() / mt_getrandmax() * $bounds['x'],
-                        'y' => mt_rand() / mt_getrandmax() * $bounds['y']
+                        'x' => self::randomFloat() * $bounds['x'],
+                        'y' => self::randomFloat() * $bounds['y']
                     ];
                 }
                 return $points;
@@ -36,8 +48,8 @@ class ProblemInitializers
                 for ($i = 0; $i < $count; $i++) {
                     $assets[] = [
                         'name' => 'Asset ' . ($i + 1),
-                        'expectedReturn' => mt_rand() / mt_getrandmax() * 0.2,
-                        'volatility' => 0.1 + mt_rand() / mt_getrandmax() * 0.3
+                        'expectedReturn' => self::randomFloat() * 0.2,
+                        'volatility' => 0.1 + self::randomFloat() * 0.3
                     ];
                 }
                 return $assets;

package/src/php/ProblemManager.php

@@ -59,17 +59,17 @@ class ProblemManager
     private function loadProblems(): void
     {
         if (!file_exists($this->configPath)) {
-            error_log("[ProblemManager] Problem config file not found: {$this->configPath}");
+            self::logError("[ProblemManager] Problem config file not found: {$this->configPath}");
             return;
         }
         $data = file_get_contents($this->configPath);
         if ($data === false) {
-            error_log("[ProblemManager] Failed to read problem config file: {$this->configPath}");
+            self::logError("[ProblemManager] Failed to read problem config file: {$this->configPath}");
             return;
         }
         $problemsFromFile = json_decode($data, true);
         if (json_last_error() !== JSON_ERROR_NONE) {
-            error_log("[ProblemManager] Failed to parse problem config JSON: " . json_last_error_msg());
+            self::logError("[ProblemManager] Failed to parse problem config JSON: " . json_last_error_msg());
             return;
         }
 
@@ -88,7 +88,7 @@ class ProblemManager
                 $problem['workUnit']['scoreFunction'] = FunctionRegistry::get($problem['workUnit']['scoreFunction']);
                 if ($problem['workUnit']['scoreFunction'] === null) {
                     // @codeCoverageIgnoreStart
-                    error_log("[ProblemManager] Warning: scoreFunction '{$problem['workUnit']['scoreFunction']}' not found in registry for problem '{$problem['id']}'.");
+                    self::logError("[ProblemManager] Warning: scoreFunction '{$problem['workUnit']['scoreFunction']}' not found in registry for problem '{$problem['id']}'.");
                     // @codeCoverageIgnoreEnd
                 }
             }
@@ -167,7 +167,7 @@ class ProblemManager
                 $task['solverName'] = $problem['workUnit']['solverName'];
                 break;
             default:
-                error_log("[ProblemManager] Unknown useful work type: {$problem['workUnit']['type']}");
+                self::logError("[ProblemManager] Unknown useful work type: {$problem['workUnit']['type']}");
                 return null;
         }
 
@@ -198,17 +198,17 @@ class ProblemManager
                 if (isset($solutionData['solution']) && isset($solutionData['energy'])) {
                     $scoreFunction = $problem['workUnit']['scoreFunction'] ?? null;
                     if (!$scoreFunction) {
-                        error_log("[ProblemManager] No score function defined for {$problemId}.");
+                        self::logError("[ProblemManager] No score function defined for {$problemId}.");
                         return;
                     }
                 // DoS mitigation: validate solution size and structure
                 if (is_array($solutionData['solution']) && count($solutionData['solution']) > 500) {
-                    error_log("[ProblemManager] Solution array too large for {$problemId} verification.");
+                    self::logError("[ProblemManager] Solution array too large for {$problemId} verification.");
                     return;
                 }
                 $serializedSolution = json_encode($solutionData['solution']);
                 if ($serializedSolution !== false && strlen($serializedSolution) > 65536) {
-                    error_log("[ProblemManager] Solution payload size exceeds safe limit for {$problemId}.");
+                    self::logError("[ProblemManager] Solution payload size exceeds safe limit for {$problemId}.");
                     return;
                 }
                     // 1. Never trust client-reported score. Recalculate server-side.
@@ -222,19 +222,19 @@ class ProblemManager
                         $problem['state']['bestEnergy'] = $recalculatedEnergy; // 3. Store verified score
                         $problem['state']['lastUpdate'] = (new \DateTime())->format(\DateTime::ATOM);
                         $stateChanged = true;
-                        error_log("[ProblemManager] New best solution for {$problemId}: {$recalculatedEnergy}"); // @phpstan-ignore-line
+                        self::logError("[ProblemManager] New best solution for {$problemId}: {$recalculatedEnergy}"); // @phpstan-ignore-line
                     }
                 }
                 break;
             case 'genetic_algorithm_generations':
                 if (isset($solutionData['population']) && is_array($solutionData['population'])) {
                 if (count($solutionData['population']) > 150) {
-                    error_log("[ProblemManager] Population size exceeds safe limit for {$problemId}.");
+                    self::logError("[ProblemManager] Population size exceeds safe limit for {$problemId}.");
                     return;
                 }
                 foreach ($solutionData['population'] as $ind) {
                     if (isset($ind['chromosome']) && is_array($ind['chromosome']) && count($ind['chromosome']) > 100) {
-                        error_log("[ProblemManager] Chromosome size too large for {$problemId}.");
+                        self::logError("[ProblemManager] Chromosome size too large for {$problemId}.");
                         return;
                     }
                 }
@@ -251,7 +251,7 @@ class ProblemManager
                                 $recalculated = $fitnessFunction($individual['chromosome'], $problem['payload'] ?? []);
                                 if (isset($individual['fitness']) && $individual['fitness'] !== -1) {
                                     if (abs($individual['fitness'] - $recalculated) > 1e-4) {
-                                        error_log("[ProblemManager] Cheating detected for {$problemId}! Reported: {$individual['fitness']}, recalculated: {$recalculated}");
+                                        self::logError("[ProblemManager] Cheating detected for {$problemId}! Reported: {$individual['fitness']}, recalculated: {$recalculated}");
                                         return; // Reject inconsistent population
                                     }
                                 }
@@ -272,7 +272,7 @@ class ProblemManager
                 }
                 break;
             default:
-                error_log("[ProblemManager] Integration not implemented for useful work type: {$problem['workUnit']['type']}");
+                self::logError("[ProblemManager] Integration not implemented for useful work type: {$problem['workUnit']['type']}");
                 break;
         }
         // Persist updated state to datastore
@@ -294,7 +294,7 @@ class ProblemManager
         if (!empty($newFront) && json_encode($newFront) !== json_encode($currentFront)) {
             $problem['state']['paretoFront'] = $newFront;
             $problem['state']['lastUpdate'] = (new \DateTime())->format(\DateTime::ATOM);
-            error_log("[ProblemManager] New Pareto front for {$problem['id']} with " . count($newFront) . " solutions."); // @phpstan-ignore-line
+            self::logError("[ProblemManager] New Pareto front for {$problem['id']} with " . count($newFront) . " solutions."); // @phpstan-ignore-line
             return true;
         }
         return false;
@@ -407,4 +407,10 @@ class ProblemManager
     {
         return $this->problems;
     }
+
+    private static function logError(string $message): void
+    {
+        // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- ProblemManager logging
+        error_log($message);
+    }
 }

package/src/php/Tests/FingerprintEngineTest.php

@@ -304,6 +304,9 @@ class FingerprintEngineTest extends TestCase
         }
 
         $configDir = dirname(__FILE__, 3) . '/config'; // Match engine's behavior
+        if (!is_dir($configDir)) {
+            mkdir($configDir, 0777, true);
+        }
         $keyPath = $configDir . '/ed25519_key.json';
 
         Env::clear('ED25519_PRIVATE_KEY');
@@ -328,7 +331,9 @@ class FingerprintEngineTest extends TestCase
         $this->assertEquals(Env::get('ED25519_PRIVATE_KEY'), $stored['privateKey']);
         $this->assertEquals(Env::get('ED25519_PUBLIC_KEY'), $stored['publicKey']);
 
-        unlink($keyPath);
+        if (file_exists($keyPath)) {
+            unlink($keyPath);
+        }
     }
 
     public function testEd25519KeyLoadingFromDisk(): void

package/src/php/Tests/ThreatIntelTest.php

@@ -0,0 +1,64 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use Anonympins\Fingerprint\Ja3AnomalyDetector;
+use Anonympins\Fingerprint\RequestContext;
+use Anonympins\Fingerprint\Store\InMemoryStore;
+use Anonympins\Fingerprint\Store\StoreManager;
+use Anonympins\Fingerprint\Utils\RequestUtils;
+use PHPUnit\Framework\TestCase;
+
+class ThreatIntelTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        StoreManager::configureStore(new InMemoryStore());
+    }
+
+    public function testRttProxyScoreReturnsZeroForCoherentTurnaround(): void
+    {
+        $reqTime = 1700000000000;
+        $context = new RequestContext(
+            '127.0.0.1', '/',
+            [
+                'x-tcp-rtt' => '15',
+                'x-behavior-metrics' => json_encode(['clientTimestamp' => $reqTime - 30])
+            ],
+            [], null, [], '1.1', $reqTime
+        );
+
+        $score = Ja3AnomalyDetector::getRttProxyScore($context);
+        $this->assertEquals(0.0, $score);
+    }
+
+    public function testRttProxyScoreIgnoresSlowConnectionWithoutTcpRtt(): void
+    {
+        $reqTime = 1700000000000;
+        $context = new RequestContext(
+            '127.0.0.1', '/',
+            ['x-behavior-metrics' => json_encode(['clientTimestamp' => $reqTime - 450])],
+            [], null, [], '1.1', $reqTime
+        );
+
+        $score = Ja3AnomalyDetector::getRttProxyScore($context);
+        $this->assertEquals(0.0, $score, 'A slow connection without TCP RTT context should not trigger a false positive.');
+    }
+
+    public function testRttProxyScoreContinuouslyPenalizesResidentialTunneling(): void
+    {
+        $reqTime = 1700000000000;
+        $context = new RequestContext(
+            '127.0.0.1', '/',
+            ['x-tcp-rtt' => '10', 'x-behavior-metrics' => json_encode(['clientTimestamp' => $reqTime - 300])],
+            [], null, [], '1.1', $reqTime
+        );
+
+        $score = Ja3AnomalyDetector::getRttProxyScore($context);
+        $this->assertGreaterThan(75.0, $score);
+        $this->assertLessThanOrEqual(95.0, $score);
+    }
+}

package/src/php/Utils/Env.php

@@ -1,50 +1,52 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Utils;
-
-class Env
-{
-    /** @var array<string, mixed> */
-    private static array $localCache = [];
-
-    /**
-     * @param string $key
-     * @param mixed $default
-     * @return mixed
-     */
-    public static function get(string $key, $default = null)
-    {
-        if (array_key_exists($key, self::$localCache)) {
-            return self::$localCache[$key];
-        }
-        if (isset($_ENV[$key]) && $_ENV[$key] !== '') {
-            return $_ENV[$key];
-        }
-        if (isset($_SERVER[$key]) && $_SERVER[$key] !== '') {
-            return $_SERVER[$key];
-        }
-        $val = getenv($key);
-        if ($val !== false && $val !== '') {
-            return $val;
-        }
-        return $default;
-    }
-
-    public static function set(string $key, $value): void
-    {
-        self::$localCache[$key] = $value;
-        $_ENV[$key] = $value;
-        $_SERVER[$key] = $value;
-        @putenv("{$key}={$value}");
-    }
-
-    public static function clear(string $key): void
-    {
-        unset(self::$localCache[$key]);
-        unset($_ENV[$key]);
-        unset($_SERVER[$key]);
-        @putenv($key);
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Utils;
+
+class Env
+{
+    /** @var array<string, mixed> */
+    private static array $localCache = [];
+
+    /**
+     * @param string $key
+     * @param mixed $default
+     * @return mixed
+     */
+    public static function get(string $key, $default = null)
+    {
+        if (array_key_exists($key, self::$localCache)) {
+            return self::$localCache[$key];
+        }
+        // phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- Environment and server variables may contain raw cryptographic keys.
+        if (isset($_ENV[$key]) && $_ENV[$key] !== '') {
+            return $_ENV[$key];
+        }
+        if (isset($_SERVER[$key]) && $_SERVER[$key] !== '') {
+            return $_SERVER[$key];
+        }
+        // phpcs:enable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash
+        $val = getenv($key);
+        if ($val !== false && $val !== '') {
+            return $val;
+        }
+        return $default;
+    }
+
+    public static function set(string $key, $value): void
+    {
+        self::$localCache[$key] = $value;
+        $_ENV[$key] = $value;
+        $_SERVER[$key] = $value;
+        @putenv("{$key}={$value}");
+    }
+
+    public static function clear(string $key): void
+    {
+        unset(self::$localCache[$key]);
+        unset($_ENV[$key]);
+        unset($_SERVER[$key]);
+        @putenv($key);
+    }
 }