owasp crs sandbox have TRACE enabled in apache

Hi, that just a minor bug worth to fix

OPTIONS / HTTP/1.1
Host: sandbox.coreruleset.org
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Max-Forwards: 0
x-crs-version: latest
x-crs-paranoia-level: 4
x-format-output: txt-matched-rules-extended
Priority: u=0, i
Te: trailers
Connection: keep-alive
Content-Length: 0

and then

HTTP/1.1 200 OK
Date: Tue, 08 Sep 2026 15:04:58 GMT
Content-Type: text/plain
Connection: keep-alive
X-Unique-ID: aqAkGqCugG_OVQ9wq6bKHwAAAE8
Allow: TRACE
x-backend: apache-latest
Content-Length: 167

This payload has been tested against the OWASP CRS web application firewall. 
The test was executed using the apache engine and CRS version latest.

No rules matched.

it reveal TRACE in the list, when setting Max-Forwards to 0, Trace need be disabled at the apache level

The report targets the Apache configuration behind the CRS sandbox and its handling of TRACE when Max-Forwards is 0. Start by locating the sandbox image's Apache configuration and reproduce the shown OPTIONS request; it is done when the response no longer advertises Allow: TRACE.