Release v0.2.13 Framework - CorsMiddleware: env-var origins (ZEALPHP_CORS_ORIGINS) + one-time warning when defaulting to wildcard '*'. Backward-compatible. - static_handler_locations default fixed — trailing-slash directory entries prevent /js intercepting /json (and similar prefix collisions). Main repo demo / website - app.php cleanup: PSR-12, drop hardcoded TZ + backtick git describe, fix /json session leak, remove /exittest (calls exit() = worker kill) and 9 other junk demo routes. - Demo middleware moved to examples/ with honest names. Triggered by public app.php line-by-line review. Full trace in CRITIC.md.