Download the PHP package iamariezflores/php-sec-check without Composer
On this page you can find all versions of the php package iamariezflores/php-sec-check. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package php-sec-check
php-sec-check
A lightweight CLI tool to scan PHP and Laravel projects for common security risks.
Overview
php-sec-check is a Composer dev tool that audits your PHP or Laravel project for security misconfigurations and vulnerabilities in seconds. Run it from the command line — no setup required.
The package has no runtime dependencies. PHPUnit is included as a dev dependency for running the test suite during development and contributions.
Features
Generic PHP Checks
These run on any PHP project:
| Check | Description |
|---|---|
| PHP Version | Warns if your PHP version is below 8.0 |
| Display Errors | Detects if display_errors is enabled (exposes stack traces in production) |
| Composer Audit | Runs composer audit to surface known CVEs in your dependencies |
| Dangerous Functions | Checks if high-risk functions are unrestricted in php.ini |
Dangerous functions checked:
exec, shell_exec, system, passthru, eval, create_function, proc_open, popen, curl_exec, curl_multi_exec, parse_ini_file, show_source
Laravel-Specific Checks
Auto-detected when artisan and bootstrap/app.php are present:
| Check | Description |
|---|---|
APP_DEBUG Check |
Warns if APP_DEBUG=true, critical if combined with APP_ENV=production |
| Default Credentials | Warns if DB_USERNAME uses a default value (root, admin, etc.) or DB_PASSWORD is empty |
.env Credentials |
Scans for exposed sensitive keys (e.g. APP_KEY, DB_PASSWORD) |
| Vendor in Git | Warns if vendor/ is not excluded in .gitignore |
Requirements
- PHP >= 8.2
- Composer
Installation
Install as a dev dependency via Composer:
Available on Packagist: iamariezflores/php-sec-check
Usage
From your project root, run:
The tool exits with code 0 when no issues are found, and code 1 when any issue is detected. This makes it compatible with any CI/CD pipeline out of the box.
Example Output
CI/CD Integration
Because sec-check exits with code 1 on any finding, you can drop it directly into your pipeline and it will fail the build automatically when issues are detected.
GitHub Actions:
GitLab CI:
Makefile / Shell script:
Configuration
On first run, php-sec-check automatically creates a php-sec-check-config.php file at your project root. Edit this file to add your own sensitive .env key names:
Advanced Usage
Programmatic Usage (Laravel)
You can invoke individual checks directly in your code. This is useful for building custom security dashboards or audit routes:
Adding Custom Checks
All checks implement the CheckInterface contract:
To add a new check, create a class in src/Checks/ that implements CheckInterface, then register it in bin/sec-check.
Running Tests
The test suite uses PHPUnit and covers all PHP and Laravel checks:
Tests live in tests/Checks/ and tests/Checks/Laravel/, mirroring the src/ structure.
Contributing
Contributions are welcome and encouraged!
- Fork the repository
- Create a feature branch:
git checkout -b feature/your-check-name - Implement your check in
src/Checks/, following theCheckInterfacecontract - Write tests for your check in the corresponding
tests/Checks/directory — PRs without tests will not be merged - Verify the full suite passes:
composer test - Commit your changes:
git commit -m "feat: add your-check-name check" - Push to your fork and open a Pull Request
Guidelines:
- Keep checks modular and focused on a single security concern
- Every new check class must have a corresponding
*Test.phpfile - Every bug fix must include a regression test that would have caught the bug
- Tests must pass before a PR will be reviewed
License
This project is open-source software licensed under the MIT License.
