- Incident handling How engineers respond to an outage, a regression or a security incident on an Exponential site - triage, the tools for each symptom (maintenance mode, repair from the browser, error references, logs, audit trail…
- Multi-site installations How one Exponential installation serves several sites - siteaccesses per site and language, shared or separate content trees, per-site settings inside extensions, per-site logs, caches and INI caches, cross-site links…
- Internationalization and right to left The internationalization model of Exponential for engineers - locales from CLDR data, content languages stored as bits of a language mask with a limit of 62, translation catalogues in Qt Linguist format, fallbacks…
- Testing strategy How Exponential is tested and how to test your own changes - the layers from syntax checks and static analysis to DB-less PHPUnit suites, database tests, live-installation tests, design and quality tests, benchmarks and…
- DB-less tests and test suites How the PHPUnit configuration of Exponential is organized - the bootstrap, the suites in phpunit.xml, the excluded groups, the PHPUnit version per PHP version - and how to write and run tests that need no database, plus…
- Static analysis and code style How Exponential checks code without running it - PHPStan at level 1 against a baseline of inherited findings, PHP_CodeSniffer with the project's own style and sniffs (no PHP 7+ type declarations, PHP 8.0 compatibility)…
- CI gates The continuous integration of Exponential as a set of gates - the Quality, PHPUnit, Performance and CI health workflows, what blocks and what only warns, how pull requests are tested as merged into main, how to…
- Code review checklist A checklist for reviewing a change to the Exponential kernel or an extension - scope and history, layering and naming, compatibility with PHP 8.0 and every database and server, tests, caches and deploy, settings…
- Design review checklist A checklist and template for reviewing the technical design of a system built on Exponential - requirements and fit, product and stack, content model, data and database, runtime and caching, scaling and availability…
- Handling technical debt How technical debt is found, recorded and reduced in Exponential - the known gaps sections of the standards, the PHPStan baseline, checks that fail only on new problems, deprecations without removal dates, plain-file…
- Release engineering How releases of Exponential and its extensions are made - the main branch and its 6.0.x-dev alias, where the kernel version lives, the extension release procedure with ezinfo.php and extension.xml, the file manifest…
- Version numbers and immutable tags The two release rules every Exponential engineer must know - the last position of a version keeps counting (0.0.4.9 is followed by 0.0.4.10), and a published tag or release is never moved, deleted, re-cut or replaced…
- Changelogs and upgrade notes Where Exponential records what changed and what an installation has to do about it - the changelog pages per version and per extension, the Added, Updated, Removed and Renamed sections, the upgrade notes in…
- Dependency management with Composer How Exponential manages its dependencies with Composer - the root package and its type, extensions as se7enxweb packages with tilde constraints, no committed lock file, the branch alias for main, the development tools…
- Backward compatibility policy What counts as a breaking change in Exponential - settings, templates, PHP API, database, command line, behavior and files - the rules that come with one (upgrade notes, opt-in behavior, safe defaults, no renamed…
- Security engineering overview The security model of Exponential for engineers - access control through policies, output escaping, safe SQL, CSRF tokens, the secure defaults of 2026, the HTTP security layer, authentication and two-factor sign-in, the…
- HTTP security: headers, CSP, request rules and proxies The HTTP security layer of Exponential - security headers from SecurityHeaders[], the Content Security Policy with modes, directives, nonces and reports, request rules that allow, deny, redirect or log after URL…
- Authentication, sessions and two-factor sign-in How users and machines authenticate to Exponential - password storage and policy, the list of well-known passwords, lockout, session handlers and cookies, two-factor sign-in with sevenx_authentication_2fa, OAuth 2.0 and…
- Security review checklist A checklist for reviewing a change to Exponential or an extension for security - access control, input and output, SQL and shell, CSRF, files and uploads, redirects, secrets, logging and privacy, HTTP headers and CSP…
- API design: REST, ezjscore and headless The interfaces Exponential offers to other systems and front ends - the REST content API of ezprestapi at v1 and v2, OAuth 2.0 and personal API keys, the ezjscore call interface and expservices, outgoing audit webhooks…
Documentation license
This documentation is free documentation, licensed under the GNU Free Documentation License 1.3 or later.
Exponential Copyright © 1998-2026 Exponential Foundation and 7x