Report vulnerabilities privately to the maintainer (see composer.json / the GitHub repository owner), not in public issues. The SAPI reads no php.ini from the host and runs only the phar found beside its own executable or named by VENUSIAN_PHAR.