Polished source readability, expanded documentation, and added 'SECURITY.md'.

[AlexSkrypnyk]

Summary

This is a documentation and readability polish pass with no behavioural change: all 144 PHPUnit tests, all 14 Behat scenarios (153 steps), PHPCS, PHPStan level 9, Rector and gherkinlint pass unchanged. Nested conditionals in PhpServerContext and ApiServerContext were flattened into guard clauses, a couple of redundant variables were removed, and comments were either deleted for restating the code they sat above or rewritten from imperative to declarative phrasing. The README gained previously undocumented constructor options and steps, a context options table, a full HTTP endpoint reference table, and a note that response bodies must be base64-encoded on a direct API call. SECURITY.md was added, and the README's Maintenance section was replaced with a pointer to CONTRIBUTING.md, which gained the template-update note in its place.

Changes

Source readability

• PhpServerContext::start() - moved a comment that sat between sprintf( and its first argument above the statement, and turned the assign-or-throw block into a guard clause so the success path is no longer nested.
• PhpServerContext::getPidNetstat() - replaced five levels of nesting with three continue guards.
• ApiServerContext::apiWillRespondWithFile() - dropped $file_found (redundant with the $absolute_path check) and $error_paths (an exact copy of $this->fixturesPaths on the throw path).
• Added blank lines before return statements and if blocks at 15 spots for consistent vertical rhythm.
• Deleted 3 comments that restated the code they sat above, and rewrote 9 from imperative to declarative phrasing; no comment's claim changed.

Documentation

• Documented the previously undocumented connection_timeout and retry_delay constructor options, the the API has no responses and I debug API requests steps, and the alternative step phrasings, in a new context options table and a full HTTP endpoint table.
• Recorded that body must be base64-encoded on a direct PUT /admin/responses call, since Response::fromArray() base64-decodes it; the previous JSON example implied a plain string.
• Fixed an alt="Yourproject logo" template leftover, an empty href="" link, and a duplicated "API server server" phrase.
• Reflowed hand-wrapped prose to single lines, and brought every embedded code example within 80 columns.
• Removed the README Maintenance section, since its lint and test content already lives in CONTRIBUTING.md, and left a Contributing pointer in its place. Added a template-update pointer to CONTRIBUTING.md.
• Added SECURITY.md, which the repository lacked.

Before / After

BEFORE                                    AFTER
┌──────────────────────────────┐          ┌──────────────────────────────┐
│ if ($success) {               │          │ if (!$success || ...) {      │
│   ┌────────────────────────┐  │          │   debug(...)                 │
│   │ happy path (nested)     │  │          │   throw ...                  │
│   └────────────────────────┘  │          │ }                             │
│ }                              │          │                               │
│ else {                         │          │ happy path (top level)       │
│   debug(...)                   │          │                               │
│   throw ...                    │          │                               │
│ }                               │          │                               │
└──────────────────────────────┘          └──────────────────────────────┘
   success path nested one level              guard clause, flat success path
   deeper than the failure path

┌──────────────────────────────┐          ┌──────────────────────────────┐
│ foreach ($parts as $part) {   │          │ foreach ($parts as $part) {  │
│   if (str_contains(...)) {    │          │   if (!str_contains(...)) {  │
│     if (count(...) > 1) {     │          │     continue;                │
│       if (is_numeric(...)) {  │          │   }                           │
│         return $pid;          │          │   if (count(...) < 2) {      │
│       }                        │          │     continue;                │
│     }                          │          │   }                           │
│   }                            │          │   if (!is_numeric(...)) {    │
│ }                               │          │     continue;                │
└──────────────────────────────┘          │   }                           │
   4 levels of nesting in                  │   return $pid;               │
   getPidNetstat()                         │ }                             │
                                            └──────────────────────────────┘
                                               3 early continues, 1 level deep

┌──────────────────────────────┐          ┌──────────────────────────────┐
│ README.md                     │          │ README.md                    │
│  ## Maintenance                │          │  ## Contributing              │
│   - composer lint               │          │   -> see CONTRIBUTING.md      │
│   - composer test                │  ───►   └──────────────────────────────┘
└──────────────────────────────┘          ┌──────────────────────────────┐
                                            │ CONTRIBUTING.md              │
                                            │  ## Maintenance (new)        │
                                            │   -> template update pointer │
                                            └──────────────────────────────┘
                                            ┌──────────────────────────────┐
                                            │ SECURITY.md (new)            │
                                            └──────────────────────────────┘

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 20 minutes

Limit details: You’ve used all 2 included reviews currently available under your plan. You completed 88 included PR reviews in the past 7 days; at that activity level, included reviews refill at 2 reviews per hour.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 027c3808-4616-4603-8b06-ac4a4cc60c11

📥 Commits

Reviewing files that changed from the base of the PR and between 08f7672 and c40987a.

📒 Files selected for processing (6)

• CONTRIBUTING.md
• README.md
• SECURITY.md
• apiserver/index.php
• src/DrevOps/BehatPhpServer/ApiServerContext.php
• src/DrevOps/BehatPhpServer/PhpServerContext.php

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Code Coverage Report:
  2026-08-18 11:41:44

 Summary:
  Classes: 20.00% (1/5)
  Methods: 67.50% (27/40)
  Lines:   85.96% (392/456)

DrevOps\BehatPhpServer\ApiServerContext
  Methods:  75.00% ( 9/12)   Lines:  95.76% (113/118)
DrevOps\BehatPhpServer\ApiServer\ApiServer
  Methods:  50.00% ( 4/ 8)   Lines:  45.12% ( 37/ 82)
DrevOps\BehatPhpServer\ApiServer\Request
  Methods: 100.00% ( 1/ 1)   Lines: 100.00% (  1/  1)
DrevOps\BehatPhpServer\ApiServer\Response
  Methods:  66.67% ( 2/ 3)   Lines:  95.12% ( 39/ 41)
DrevOps\BehatPhpServer\PhpServerContext
  Methods:  68.75% (11/16)   Lines:  95.28% (202/212)

[codecov]

Codecov Report

❌ Patch coverage is 87.50000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 88.05%. Comparing base (08f7672) to head (c40987a).
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/DrevOps/BehatPhpServer/PhpServerContext.php	85.71%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #130      +/-   ##
==========================================
- Coverage   88.52%   88.05%   -0.47%     
==========================================
  Files           3        3              
  Lines         453      452       -1     
==========================================
- Hits          401      398       -3     
- Misses         52       54       +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.