PHP code example of bigdevwhale / laravel-secure-baseline

    
        
<?php
require_once('vendor/autoload.php');

/* Start to develop here. Best regards https://php-download.com/ */

    

bigdevwhale / laravel-secure-baseline example snippets

// ❌ Other tools
return [
    'rules' => ['rule1', 'rule2', ...], // 50 lines
    'scanners' => [...],
    'parsers' => [...],
];

// ✅ Laravel Secure Baseline
// Just run: php artisan secure:scan
// Config only needed for advanced customization

// config/secure_baseline.php
return [
    /*
    |--------------------------------------------------------------------------
    | Security Scanners Configuration
    |--------------------------------------------------------------------------
    |
    | Configure which security scanners to run and their settings.
    | You can disable scanners or customize their behavior.
    |
    */

    'scanners' => [
        'env' => [
            'enabled' => true,
            'checks' => [
                'app_debug' => true,
                'app_key' => true,
                'env_in_repo' => true,
            ],
        ],
        'session' => [
            'enabled' => true,
            'checks' => [
                'secure' => true,
                'http_only' => true,
                'same_site' => true,
                'cookie_secure' => true,
            ],
        ],
        'headers' => [
            'enabled' => true,
            'checks' => [
                'x_frame_options' => true,
                'x_content_type_options' => true,
                'x_xss_protection' => true,
                'referrer_policy' => true,
                'permissions_policy' => true,
                'csp' => true,
                'hsts' => true,
            ],
        ],
        'cors' => [
            'enabled' => true,
            'checks' => [
                'allow_all_origins' => true,
                'supports_credentials' => true,
            ],
        ],
        'https' => [
            'enabled' => true,
            'checks' => [
                'force_https' => true,
            ],
        ],
        'sensitive_data' => [
            'enabled' => true,
            'checks' => [
                'mask_sensitive' => true,
            ],
        ],
    ],

    /*
    |--------------------------------------------------------------------------
    | Exit Codes
    |--------------------------------------------------------------------------
    |
    | Configure exit codes for different scan results.
    |
    */

    'exit_codes' => [
        'success' => 0,
        'warnings' => 1,
        'failures' => 2,
    ],

    /*
    |--------------------------------------------------------------------------
    | Auto-fix Settings
    |--------------------------------------------------------------------------
    |
    | Configure auto-fix behavior.
    |
    */

    'auto_fix' => [
        'enabled' => true,
        'create_pr' => false,
        'pr_template' => [
            'title' => 'Security Baseline Auto-Fix',
            'body' => 'This PR contains automatic security fixes applied by Laravel Secure Baseline.',
        ],
    ],
];

// Only check APP_DEBUG in production
'checks' => [
    'app_debug' => app()->environment('production'),
],

// app/Scanners/CustomDatabaseScanner.php
namespace App\Scanners;

use Laravel\SecureBaseline\Contracts\ScannerInterface;

class CustomDatabaseScanner implements ScannerInterface
{
    public function scan(): array
    {
        $issues = [];
        
        // Check if database uses SSL
        $config = config('database.connections.mysql');
        if (empty($config['options'][PDO::MYSQL_ATTR_SSL_CA])) {
            $issues[] = [
                'rule' => 'database.ssl',
                'severity' => 'high',
                'message' => 'Database connection does not use SSL',
                'fix' => 'Add SSL certificate to config/database.php',
            ];
        }
        
        return $issues;
    }
    
    public function getName(): string
    {
        return 'Custom Database Scanner';
    }
}

// Register in config/secure_baseline.php
'custom_scanners' => [
    'database' => App\Scanners\CustomDatabaseScanner::class,
],

// app/Reporters/SlackReporter.php
namespace App\Reporters;

use Laravel\SecureBaseline\Contracts\ReporterInterface;
use Illuminate\Support\Facades\Http;

class SlackReporter implements ReporterInterface
{
    public function report(array $results): void
    {
        $webhookUrl = config('services.slack.webhook');
        
        $message = "🔒 Security Scan Results\n";
        $message .= "✅ Passed: " . $results['summary']['passed'] . "\n";
        $message .= "⚠️ Warnings: " . $results['summary']['warnings'] . "\n";
        $message .= "❌ Failures: " . $results['summary']['failures'];
        
        Http::post($webhookUrl, [
            'text' => $message,
            'username' => 'Security Bot',
            'icon_emoji' => ':shield:',
        ]);
    }
}

// Usage
php artisan secure:scan --format=slack

// app/Console/Kernel.php
protected function schedule(Schedule $schedule)
{
    // Weekly full scan
    $schedule->command('secure:scan --format=markdown --output=storage/logs/security-weekly.md')
             ->weekly()
             ->mondays()
             ->at('09:00')
             ->emailOutputOnFailure('[email protected]');
    
    // Daily quick scan
    $schedule->command('secure:scan --quick')
             ->daily()
             ->at('03:00');
}

// Disable specific checks
'scanners' => [
    'headers' => [
        'checks' => [
            'csp' => false,  // Disable CSP check if using Cloudflare
        ],
    ],
],

bash
php artisan secure:scan --format=sarif --output=security.sarif

bash
php artisan secure:scan --autofix --create-pr

bash
php artisan secure:scan --autofix
# Adds SecureHeadersMiddleware to app/Http/Kernel.php

bash
php artisan vendor:publish --tag=secure-baseline-config

bash
# Error: Command "secure:scan" is not defined

# Fix:
composer dump-autoload
php artisan config:clear
php artisan cache:clear

# Verify installation:
composer show bigdevwhale/laravel-secure-baseline

bash
# Use quick mode (3x faster)
php artisan secure:scan --quick

# Or disable slow scanners
# config/secure_baseline.php
'scanners' => [
    'sensitive_data' => [
        'enabled' => false,  // Log scanning is slowest
    ],
],