Using and Evaluating Null Breach.
Our goal is a safer foundation for the PHP-powered web. These notes distinguish what you can use today—source discovery through NULL TERMINAL—from experimental execution protections and the evidence they still need. Search results are not safety-verified, and destination browsing is not isolated.
Searching with NULL TERMINAL
Open the Search page (a smaller instance also sits on the home page). Type anything into the line after null> and press Enter, or press the Search button. Plain text is always a web query; there is no command syntax to learn.
Results print under your query as a numbered list. Each entry has a clickable title, the full URL, and a short description provided by the search provider. The first request returns up to ten results. When the provider reports that more exist, a More results button appears under that query's output; it appends the next page to the same query, up to ten pages, and skips URLs already shown.
Starting a new search while one is pending cancels the earlier request, and its output says so. While the input is focused, the Up and Down arrow keys recall earlier queries from this page session. Expand fills the screen with the terminal; press Escape or Exit to return, and focus goes back where it was.
Commands
| Input | Effect |
|---|---|
| /help | Prints the supported interface instructions. No network request. |
| /clear | Cancels any pending request, clears visible output and this page's query history. No network request. The Clear button does the same. |
| anything else | Searched as typed. The word help without a slash is an ordinary query. |
Result links
Result titles open the destination in a new browser tab with rel="noopener noreferrer". Only http and https URLs become links; anything else is printed as plain text. Titles and descriptions are treated as untrusted text and shown escaped.
Opening a result means your browser visits that site directly, under that site's own terms. The terminal does not fetch, preview, scan or vet destination pages, and it cannot make a link safe.
Provider and privacy
Your query leaves your device. Our server forwards it to the search provider and returns only titles, URLs, descriptions and a flag saying whether more pages exist.
Query history is held in memory on the page you are using and disappears when you clear it, reload or leave. The terminal does not write it to local storage, and the project does not keep a search-history database or add analytics to searches. The external search provider processes queries under its own policies. The search interface does not hide your identity from destination sites and does not isolate them.
Status messages
| Message | Meaning |
|---|---|
| Search is not configured | The server has no configured search connection. No results can be shown; nothing is substituted. |
| Request rejected | The query was empty, longer than 400 characters, or asked for a page outside 1 to 10. |
| Request refused | The request did not come from this site. |
| Temporarily rate limited | Short-term limits protect the shared provider quota. When the server says how long to wait, the terminal shows it. |
| Provider unavailable | The search provider returned an error or could not be reached. |
| Did not answer in time | The provider exceeded the server's timeout. The terminal also cancels after 15 seconds on its own. |
| Offline / could not reach the server | Your connection or our server is unreachable. |
| No results returned | The search provider answered and had nothing for this query. |
Provider usage limits and charges apply to the service behind this terminal; search is not unlimited.
What the terminal is not
NULL TERMINAL is source retrieval. It is not a vulnerability scanner, a PHP patch, an implementation of the Vessel Engine, a shell, a PHP interpreter, an AI assistant or a secure remote browser. It exists so you can find primary sources (language documentation, papers, issue trackers) while reading the research.
Terminology
- PROTOCOL ZR-41
- The name of the overall design study described on this site.
- Vessel Engine
- The proposed runtime that executes ZIR inside request cells. Not implemented.
- ZIR
- Zero Intermediate Representation: the explicit, region- and capability-aware IR PHP source is lowered into.
- Sealed Execution Contract
- The three obligations: request-owned mutable regions, explicit authority for effects, invalidation on termination.
- Request cell
- The runtime unit holding one request's region, capabilities, budget and open resources.
- Capability
- A typed, scoped, generation-checked grant to perform a class of effects.
- Shared service
- Mutable state outside every cell, reachable only through capabilities with copied values.
- NULL TERMINAL
- This site's web-search interface. Unrelated to the runtime design.
- $NULL
- A brand identifier for the project. It is not a token, currency or financial instrument.
Evaluation methods
A design is only as credible as the tests it is willing to fail. These are the methods ZR-41 proposes; none has been run, and no results are reported here.
Differential execution
Run the same program and inputs on the reference engine and the candidate, then compare output, return values, warnings, exceptions and their order. The Execution Notes outline one harness.
Fuzzing
Generate programs and inputs that stress coercion, references and unwinding, and treat any divergence or engine fault as a finding. Grammar-aware generators reach far more semantic corners than byte-level mutation.
Lifecycle tests
Serve thousands of sequential and concurrent requests through one worker and assert that no value, static or handle from one request is observable in another, including after errors and cancellations.
Budget enforcement
Write programs designed to exhaust each budget component and confirm that the request stops, teardown completes within its allowance, and nothing is charged to other requests.
Extension review
For each native extension, document what state it holds, which capabilities its shim exercises, and whether it can be hosted out of process.
Independent assessment
Claims about isolation should be checked by people who did not design it. Until that happens, every property on this site should be read as a design goal.