Download the PHP package jklejczyk/security-toolkit-for-laravel without Composer

Security Toolkit for Laravel

A security audit for Laravel 12 and 13 applications in one Artisan command. It reads your application from the inside (configuration, file storage, authentication, models, routes, dependencies) and reports what is wrong, why it is dangerous and how to fix it.

Early release (0.x). The checks below are tested and stable, but the report format and options may still change before 1.0. More modules (routes and authorization, dynamic probes, static analysis) are on the way.

Principles

• Few, accurate checks instead of many noisy ones. A false positive is a bug. When a check cannot decide reliably, it is skipped with a reason instead of guessing.
• Zero configuration. Install, run, read the recommendations.
• A recommendation, not just an alarm. Every finding explains the risk, the fix, and links to the Laravel documentation or OWASP.
• Justified severity. Every finding has a CWE. Findings an attacker can exploit on their own carry a CVSS 3.1 vector, and their severity follows from its score, so you can see exactly why something is rated High.

Requirements

• PHP 8.3 or newer
• Laravel 12 or 13
• Composer 2.4 or newer on the machine that runs the scan (for the dependencies module)

Installation

For scanning on your machine or in CI:

To scan on a production server, where dev dependencies are not installed, require it as a regular dependency instead (composer require). The package only adds the security:scan command; it registers no routes, middleware or listeners.

Usage

Where checks run

Rules that read code or committed config files (password rules, storage links, Sanctum, dependencies) run in every environment, so a plain php artisan security:scan on your machine or in CI already reports them.

Rules that read values Laravel takes from .env (debug mode, APP_KEY, cookie flags, dashboards) run only for a production configuration; elsewhere they are listed as skipped, because those values differ locally on purpose. To audit them:

• on the server, run php artisan security:scan there (for example as a deploy step), or
• locally with a real production env file, run php artisan security:scan --env=production, which loads .env.production. Without that file Laravel uses your local .env, so the result describes your machine, not production.

Options

Severities, from the highest: critical, high, medium, low, info. A finding rated unknown (an advisory published without a severity) is always shown and always meets the --fail-on threshold, because it could be critical.

Exit codes

In CI

This checks code and dependencies on every push. Do not add --env=production here: CI has no production .env, so the configuration rules would judge CI's values and report problems production does not have.

--format=json prints the whole report as one JSON document with findings (including confidence, cwe, cvss and cve), skipped, unavailable, errors and a summary.

Checks

The scan is split into modules, each focused on one area of the application:

• config: the application configuration that controls what an error, a key or an admin dashboard exposes.
• files: how file storage is served, and whether private files can be reached over HTTP.
• auth: session cookies, password rules and API tokens.
• models: Eloquent mass assignment protection.
• routes: authentication, authorization, scoped bindings and CSRF exclusions of your routes.
• probes: dynamic checks (DAST) that confirm the routes and models suspicions by sending real requests on a test database — opt-in and never on production.
• dependencies: known vulnerabilities and abandoned packages among the installed Composer packages.

CHECKS.md lists every rule with what it detects, its severity, CWE and CVSS score, and explains how severity is decided.

Security

Please report vulnerabilities privately, see SECURITY.md.

Credits

The list of known application keys is derived from laravel-crypto-killer by Synacktiv, see THIRD_PARTY_NOTICES.md.

Contributing

License

MIT, see LICENSE.