Our security detection picks out specific issues in-context, or escapes to make them non-issues -- trying to spot suspicious patterns across any parameter out-of-context would lead to performance slow-down and bugs.

Thank you for your filing the report though, it probably is a malicious bot.

If they had for example ".." in this parameter, we'd pick it up as a file-system attack, as this parameter is being used in a file-system context.

Is there any way that errors can track IPs, like security logs do? That way, I can ban bots like this as well as these bots/people who keep adding random URLs to the end of /pg/ .

I'll open an issue for that. Currently you'd need to look into the raw web logs.

Alright will do. Thanks ^^