BOOL, can be read and
set, but not
true by the WAF when all rules have been processed and none were matched by the request, indicating that the request is not considered a risk.
waf_debug_log subroutine, the value of
waf.passed is always
false, since the WAF does not set the value of the variable until all rules have been processed.
This variable is write-once. A second attempt to
set it will not change the value.