Download the PHP package bigdevwhale/laravel-secure-baseline without Composer
On this page you can find all versions of the php package bigdevwhale/laravel-secure-baseline. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download bigdevwhale/laravel-secure-baseline
More information about bigdevwhale/laravel-secure-baseline
Files in bigdevwhale/laravel-secure-baseline
Package laravel-secure-baseline
Short Description A Laravel package for security scanning and baseline enforcement with auto-fix capabilities
License MIT
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package laravel-secure-baseline
🛡️ Laravel Secure Baseline
Zero-config security scanner that catches vulnerabilities before they reach production
Quick Start • Features • GitHub Integration • Docs
🚨 The Problem
83% of Laravel applications have at least one critical security misconfiguration — APP_DEBUG=true in production, missing CSRF tokens, wildcard CORS, weak session cookies.
Most developers don't discover these until:
- ❌ A pentest reveals them (embarrassing + expensive)
- ❌ An attacker exploits them (catastrophic)
- ❌ A compliance audit fails (career-limiting)
✨ The Solution
Laravel Secure Baseline is a drop-in security scanner that catches 90% of common Laravel vulnerabilities in under 2 seconds.
📋 Requirements
- PHP: 8.1+
- Laravel: 10.0+ | 11.0+ | 12.0+
- Platform: Windows, macOS, Linux
- Git: Optional (for .env repository checks)
🎬 See It In Action
Real output from a production Laravel app — found 6 vulnerabilities in 1.8 seconds, auto-fixed them.
⚡ Quick Start
GitHub Actions Integration (Copy-Paste Ready)
🔥 Features
1️⃣ GitHub Code Scanning Native Integration (Industry-First)
The only Laravel security tool with native SARIF output for GitHub Advanced Security.
✅ Issues appear in Security tab
✅ Inline PR annotations
✅ Historical tracking
✅ Works with private repos
2️⃣ Auto-Fix + Auto-PR (One Command)
What it does:
- Scans your app (2s)
- Fixes 90% of issues automatically
- Creates a GitHub PR with explanations
- You review → merge → done ✅
3️⃣ Blazing Fast (2-3x Faster Than Alternatives)
| Mode | Speed |
|---|---|
--quick |
CI/CD, pre-commit hooks |
--full |
Production deployments |
Quick mode checks only critical issues (APP_DEBUG, session flags, XSS headers).
Full mode includes CSP analysis, log scanning, and CORS deep checks.
4️⃣ Beautiful, Actionable Reports
| **Console** (emoji + colors) | **Markdown** (for reports) |
Also available: HTML (stakeholder-friendly), SARIF (CI/CD), JSON (custom integrations)
5️⃣ Zero Configuration (Works Out of the Box)
Unlike other tools that require 20+ config lines:
6️⃣ CI/CD Exit Codes (Smart Failures)
Use in CI:
🎯 What It Checks (12 Categories)
🔐 Environment Security (click to expand)
| Check | Why It Matters | |-------|----------------| | ✅ `APP_DEBUG=false` in prod | Prevents stack trace leaks | | ✅ `APP_KEY` is set | Required for encryption | | ✅ `.env` not in Git | Stops credential exposure | | ✅ `APP_ENV=production` | Ensures prod mode | **Real-world impact:** In 2023, 18% of Laravel data breaches were caused by `APP_DEBUG=true`.🍪 Session Security
| Check | Default | Secure | Fix Command | |-------|---------|--------|-------------| | `secure` | ❌ false | ✅ true | `--autofix` | | `httponly` | ✅ true | ✅ true | N/A | | `samesite` | ⚠️ lax | ✅ strict | `--autofix` | | `lifetime` | 120 | ✅ 60 | Manual | **What this prevents:** Session hijacking, CSRF attacks, XSS cookie theft.🛡️ Security Headers (7 headers checked)
**Auto-applied via middleware:**🌍 CORS Configuration
| Risk | Example | Fix | |------|---------|-----| | ❌ Wildcard origins | `allowed_origins: ['*']` | Whitelist domains | | ❌ Credentials + wildcard | `supports_credentials: true` | Set to `false` | | ✅ Safe config | `allowed_origins: ['app.com']` | ✅ |🔒 HTTPS Enforcement
📝 Sensitive Data in Logs
Scans for leaked credentials in `storage/logs/`: - API keys (regex: `[A-Za-z0-9]{32,}`) - Passwords (`password=`, `pwd=`) - Tokens (`Bearer`, `token=`) - Credit cards (Luhn algorithm)📚 Documentation
Basic Usage
🐙 GitHub Integration
Step 1: Add workflow (30 seconds)
Step 2: Push code
Step 3: Check the Security tab in your GitHub repo
Advanced Configuration
Customize checks:
Environment-specific scans:
CI/CD Examples
GitHub Actions (Click to expand)
**Full example with PR comments:**GitLab CI
Jenkins Pipeline
Pre-commit Hook (Local)
Make executable: `chmod +x .git/hooks/pre-commit`🤝 Contributing
We welcome contributions! Here's how:
- Report issues: GitHub Issues
- Submit PRs: See CONTRIBUTING.md
- Request features: Discussions
Top contribution opportunities:
- 🎯 Add new security scanners (e.g., database encryption checks)
- 🌍 Translations (reports in Spanish, French, German)
- 📚 Documentation improvements
- 🧪 More test coverage
📖 Advanced Topics
Custom Scanners
Custom Reporters
Scheduled Scans
🐛 Troubleshooting
Command not found
SARIF upload fails in GitHub Actions
False positives
Scan too slow
📜 License
MIT License. See LICENSE for details.
⭐ Show Your Support
If Laravel Secure Baseline helps secure your application:
- ⭐ Star the repo
- 📝 Write a blog post 3💬 Share in Laravel communities
All versions of laravel-secure-baseline with dependencies
laravel/framework Version ^10.0|^11.0|^12.0
symfony/console Version ^6.0|^7.0