On Mon, Oct 26, 2026 at 12:27:48PM +0100, Arturo Bernal wrote: > Hi Joe, > > Looks good to me overall. Just a few thoughts, unless I'm missing something. > > For mod_lua, I don't think server/thread scopes are actually documented as > not thread-safe. My understanding is that the main concern is state > surviving across requests. I'd also be a bit cautious about excluding all > memory corruption involving persistent scopes.
OK I removed that paragraph. > For mod_heartmonitor, if I'm reading the code correctly, there's also an > HTTP "heartbeat" handler accepting POST requests. Perhaps the trust > boundary should mention that entry point too? This handler seems to only be documented in the Tomcat docs! Tweaked that para too. Thanks for the review. Regards, Joe
