what many application developers do not realize is that the HTTP host header is controlled by the user. In application security user input should always be considered unsafe and therefore, never trusted without properly validating it first.

Thanks for that information. The PHP module doesn't exist in Drupal Core since version 8. As there doesn't seem to be anything actionable here, I am postponing this. If this is about adding some developer documentation you will have to explain that.

Report security bugs → in the proper place, which is not here.

The trusted hosts setting in settings.PHP allow lists valid hosts

Changes are made on on 11.x (our main development branch) first, and are then back ported as needed according to our policies.

Like #2, I do not see anything actionable here and there has been no further comment about that. And, since we have a response from a security team member, I am going to close this issue.