Code review findings: - WebGuiConfigScore: write PHP script to temp file via SSH instead of inline php -r with shell escaping. Eliminates the shell quoting attack surface entirely (port is u16 so was safe, but the pattern of format!() into shell commands is a code smell) - parser.rs: prefix unused parameter with underscore