[vsilent]

Follow-up to #11, which was merged before these commits were pushed.

Changes

3139ff7 fix(detectors): match webshell probes in the request URL only

web.webshell-probe matched its indicators anywhere in a log line, and this detector can ban. In stacker's agent request logs, c99 sits inside the x-request-id hex (…b1dac994f229), so agent long-polls raised a webshell alert and an offense.

The detector now reads only the extracted request. It matches:

• a cmd/exec/shell parameter;
• powershell, /bin/sh, wget http or curl http in the URL;
• a path segment starting with c99/r57.

A regression test uses the exact agent line from the alert. Trade-off: lines with no HTTP request no longer match (e.g. a cron line containing /bin/sh).

38272b8 docs(website): add a PHP shell quick start page (/php-shell-quickstart)

The page has four copy-paste steps:

1. curl install;
2. recommended /etc/stackdog/stackdog.env:
   • API on 127.0.0.1;
   • /var/www plus nginx/Apache access logs;
   • bans at 5 offenses in 5 min, 30 min duration, 10/min cap;
   • AI-finding bans off;
   • high alert threshold;
3. a systemd unit running stackdog serve;
4. an inert self-test file.

It also covers proxy/Cloudflare real_ip and everyday commands. It is linked from the detection page, the footer and the sitemap.

39a225a chore: move the site domain to stackdog.app

The domain changes in website/lib/config.ts, website/.env.local.example, the default Slack avatar (src/alerting/notifications.rs), .env.sample, the docs page and install.sh. https://stackdog.app/stackdog-mark.png answers 200; the GitHub copy stays the avatar fallback.

Verification

• cargo test: 446 + 8 + 108 passed, 0 failed, 1 ignored. cargo clippy --all-targets -- -D warnings is clean.
• cd website && npm run build: OK. /php-shell-quickstart was checked at 390px with no horizontal overflow.

Not verified

• The quick-start steps (systemd unit, self-test, grep on /api/alerts) have not been run on a server.
• The curl command installs the latest release. PHP shell detection reaches users only once a release after v0.2.6 is published.
• https://stackdog.app/php-shell-detection returned 404 at the time of writing, so the site has not been redeployed since feat: PHP webshell detection with alert + IP ban #11.
• The proxy entry in the separate sites repo (sites/stacker.yml) was edited locally but is not part of this PR.

🤖 Generated with Claude Code