Software engineering
Software engineering on Exponential: architecture, the request cycle, caching, testing and quality.
40 pages
- DB-less tests and test suites How the PHPUnit configuration of Exponential is organized - the bootstrap, the suites in phpunit.xml, the excluded groups, the PHPUnit version per PHP version - and how to write and run tests that need no database, plus…
- Static analysis and code style How Exponential checks code without running it - PHPStan at level 1 against a baseline of inherited findings, PHP_CodeSniffer with the project's own style and sniffs (no PHP 7+ type declarations, PHP 8.0 compatibility)…
- CI gates The continuous integration of Exponential as a set of gates - the Quality, PHPUnit, Performance and CI health workflows, what blocks and what only warns, how pull requests are tested as merged into main, how to…
- Code review checklist A checklist for reviewing a change to the Exponential kernel or an extension - scope and history, layering and naming, compatibility with PHP 8.0 and every database and server, tests, caches and deploy, settings…
- Handling technical debt How technical debt is found, recorded and reduced in Exponential - the known gaps sections of the standards, the PHPStan baseline, checks that fail only on new problems, deprecations without removal dates, plain-file…
- Release engineering How releases of Exponential and its extensions are made - the main branch and its 6.0.x-dev alias, where the kernel version lives, the extension release procedure with ezinfo.php and extension.xml, the file manifest…
- Version numbers and immutable tags The two release rules every Exponential engineer must know - the last position of a version keeps counting (0.0.4.9 is followed by 0.0.4.10), and a published tag or release is never moved, deleted, re-cut or replaced…
- Changelogs and upgrade notes Where Exponential records what changed and what an installation has to do about it - the changelog pages per version and per extension, the Added, Updated, Removed and Renamed sections, the upgrade notes in…
- Dependency management with Composer How Exponential manages its dependencies with Composer - the root package and its type, extensions as se7enxweb packages with tilde constraints, no committed lock file, the branch alias for main, the development tools…
- Backward compatibility policy What counts as a breaking change in Exponential - settings, templates, PHP API, database, command line, behavior and files - the rules that come with one (upgrade notes, opt-in behavior, safe defaults, no renamed…
- Security engineering overview The security model of Exponential for engineers - access control through policies, output escaping, safe SQL, CSRF tokens, the secure defaults of 2026, the HTTP security layer, authentication and two-factor sign-in, the…
- HTTP security: headers, CSP, request rules and proxies The HTTP security layer of Exponential - security headers from SecurityHeaders[], the Content Security Policy with modes, directives, nonces and reports, request rules that allow, deny, redirect or log after URL…
- Authentication, sessions and two-factor sign-in How users and machines authenticate to Exponential - password storage and policy, the list of well-known passwords, lockout, session handlers and cookies, two-factor sign-in with sevenx_authentication_2fa, OAuth 2.0 and…
- Security review checklist A checklist for reviewing a change to Exponential or an extension for security - access control, input and output, SQL and shell, CSRF, files and uploads, redirects, secrets, logging and privacy, HTTP headers and CSP…
- API design: REST, ezjscore and headless The interfaces Exponential offers to other systems and front ends - the REST content API of ezprestapi at v1 and v2, OAuth 2.0 and personal API keys, the ezjscore call interface and expservices, outgoing audit webhooks…
- Git workflow How Git is used for Exponential - main as the one development line, branches and pull requests squashed and rebased while open, merge commits, no history rewriting after a merge, commit subjects with Added, Updated…
- Contributing upstream How an engineer sends a change to the Exponential kernel or one of its extensions - forking and branching, the checks to run first, the copyright assignment (CLA) required for kernel contributions and what it means…
- Documentation as code How Exponential treats its documentation like code - Markdown files in doc/ versioned with the kernel, served by the help system inside the administration, front matter that drives audiences and search, a link and image…
- Software engineer FAQ Short answers to the questions software engineers ask first about Exponential - language and versions, frameworks and PSRs, ORM and migrations, databases, servers, statics, caches, tests, releases, security reports…
- Glossary for software engineers The Exponential terms a software engineer meets, from audit trail and baseline to zygote, each defined in one or two sentences with the page that explains it, and mapped to the nearest term of other frameworks where one…
Documentation license
This documentation is free documentation, licensed under the GNU Free Documentation License 1.3 or later.
Exponential Copyright © 1998-2026 Exponential Foundation and 7x