@davidhund Probably not, but the PHP script does need to write to webroot to add and update threads. No need to set execute on anything but the PHP. Anyway, the code sanitizes the user’s input so that they can’t mess with the server. If there are any security flaws, hopefully people will report them, it is open source after all.