Sebb thank you for your analysis!
Two issues; one, the reply-to field of security announcements was set to
security@, and this is in direct contravention of Apache policy. Security@
is exclusively for reporting undisclosed vulnerabilities, and all other
traffic is ignored. This group of email
I'd like to add a "persistent state" directory with a hard-coded
default, config directive and API equivalent to the runtimdir in
config.layout, DefaultRuntimeDir directive and
ap_runtime_dir_relative(). The "runtime" directory is used for
transient state which disappears and can be deleted
