How it works
How it works
Mechanism, not marketing. These two pages explain the machinery a webshell scanner is built from — the parts that are the same whoever builds them, and the parts where the design choices show.
Real-time detection
fanotify against inotify, why a scanner needs a privilege split, what happens when the event queue overflows, and why 'not scanned' has to be its own answer.
The upload gate
Why PHP's auto_prepend_file is the right hook for scanning uploads on OpenLiteSpeed, what fail-open really costs, and the limitation nobody else prints on the box.