Download the PHP package mahdisphp/laravel-hack-auditor without Composer

Watch AI hack your Laravel app in 15 seconds.

Watch AI literally hack a vulnerable Laravel controller in front of your eyes — no setup, no API key.

That's it. Two commands. Watch 12 vulnerabilities get ripped out of a controller in your terminal.

The commands

hack:scan finds what PHPStan and Snyk can't:

• "This endpoint fetches a user by ID but never checks ownership" (IDOR)
• "Admin check reads is_admin from the request, not the session" (Auth bypass)
• "Login route has no throttle middleware" (Brute-forceable)
• "Any authenticated user can set their own plan to 'pro' without payment" (Auth bypass)

20 vulnerability types. OWASP Top 10 mapped, each with a CWE id. Every finding has file, line and an explanation — and a suggested fix only when the scanner can prove every identifier it would name. See Precision.

Deterministic detection engine — not just the AI

Alongside the AI pass, framework-aware detectors run on every scan and merge into the report, giving reproducible coverage that doesn't drift with AI run-to-run variance: IDOR / broken access control (policy-vs-route mismatch, is_admin in $fillable, unauthorized find()/findOrFail() exposure), SSRF (Http::get()/cURL with a user-controlled URL), and sensitive-data exposure (password/token/secret fields returned in a response). These are the OWASP-#1 access-control bugs generic SAST and generic AI both miss because they don't understand Laravel.

The engine parses your code into a real AST (nikic/php-parser) and resolves Laravel semantics before deciding anything: what a receiver's type is, so an Eloquent ->get() and a local service's ->delete() are not mistaken for HTTP calls; which abilities a Policy actually declares, so a missing store ability is not reported as a bypass; and that $request->user() is the authenticated user rather than attacker-controlled input. Earlier versions pattern-matched raw source and got all three wrong.

Measured accuracy — and what the measurement is worth

hack:benchmark runs the scanner against the labeled corpus in tests/Fixtures/benchmark/ and reports precision / recall / F1 overall and per type, usable as a CI gate (--min-f1). It ships in the repo — run it yourself.

Read the number for what it is. That corpus is synthetic: every sample was authored alongside the detectors, and the routes that expose them are declared in the corpus's own routes.php. It is a recall check and a regression gate — "does the engine still find the bugs it is supposed to find" — not a precision claim about real code. Nothing in it has the ambiguity, framework idiom or deliberate-by-design pattern that produces false positives in a real application. The command prints this caveat with every result so a number copied out of a terminal carries its own scope. Real-code precision is measured separately, against unmodified third-party Laravel applications.

--deterministic scores only the labels the provider-independent detectors own, so the reproducible half of the scanner can be gated on every commit with no API key.

Why the corpus ships a route manifest. The access-control engine refuses to report a record exposure it cannot attribute to a routed entry point — the rule that took 191 false IDOR reports on 6,221 real files down to zero. Standalone fixture files have no application around them, so without a route table every sample resolved to unreachable and was dropped before analysis: the gate kept printing a score for detectors it had stopped exercising. tests/Fixtures/benchmark/routes.php gives the corpus what a real app has. The reachability rule is untouched; a controller sample with no route entry now fails the run loudly rather than being silently unmeasured.

Call it from your AI editor

mcp:start hack-auditor exposes the scanner as MCP tools (scan_path, scan_diff, explain_finding) so Claude Code, Cursor, and other agents can run a real taint-aware Laravel audit mid-edit instead of guessing.

Precision, measured on real code

The measurement. The deterministic engine was run over 6,221 files from six large open-source Laravel applications — Monica, Akaunting, Pixelfed, BookStack, Snipe-IT, Koel — plus the Laravel framework's own src/. None of them was consulted while writing the detectors.

Zero asserted findings on well-maintained real code. Recall was held while getting there: the deliberately-vulnerable laravel-vuln-lab still yields all 7 of its planted access-control findings.

Two finding classes, because certainty and severity are different questions. Severity answers "how bad if real"; it cannot express "how sure am I". Conflating them is how a scanner ships confident nonsense.

• Confirmed vulnerability — every link of the evidence chain was resolved from your code: an attacker-controlled source, the sink it reaches, and the absence of a guard on the path. Only these are counted, scored, and allowed to fail a build.
• Needs review — security-sensitive code the scanner cannot prove either way, phrased as a question and excluded from the count, the score and the exit code. A review item never carries a suggested fix.

That second rule is structural, not a convention: a review finding's fix string is dropped in Vulnerability's constructor, so a detector cannot reintroduce one by forgetting. It exists because this tool has shipped fixes that break applications — advising an ability that a policy never declared, and advising the removal of a $fillable column that a multi-tenant app needed to stay tenant-scoped.

A suggested fix must survive every one of these, or none is emitted and the finding explains why instead:

• the finding is a confirmed vulnerability, never a review item;
• every identifier it names was resolved from the analysed file — policy classes are quoted from the class actually resolved, never synthesised as {Model}Policy;
• every variable it names is definitely assigned on all paths to the insertion point, so a binding inside a try/catch, a match arm or a loop body is never named;
• the method it advises calling is actually callable on that class.

What we cannot see. Route middleware registered at runtime, dynamically resolved policies, gates defined in service providers, anything reached via __call, and authorization enforced outside the analysed file set. That is exactly why the review class exists.

Multi-pass verification (v1.6)

Pass --verify to have the AI attempt a concrete exploit for every HIGH or CRITICAL finding. Findings the model can exploit retain their severity and ship with a copy-paste exploit payload (exploit_proof). Findings it cannot exploit are downgraded one tier (Critical→High, High→Medium) with the original severity preserved in original_severity for audit trail — a placeholder or hedging response is treated as no-exploit.

⚠️ --verify approximately doubles API cost on scans with many HIGH+ findings. Recommended for pre-release audits, not every CI run. Enable by default via HACK_AUDITOR_VERIFY=true.

Technical failures (AI timeouts, malformed responses) leave the finding untouched rather than downgrading on noise. The JSON output gains a verification sub-object with verified/downgraded counts and a separate token bucket so pass-1 and pass-2 cost are distinguishable.

Token usage & cost tracking

Every scan shows token consumption and estimated cost. Auto-detects your AI provider's pricing from a built-in registry of 30+ models (Anthropic, OpenAI, Gemini, xAI, Ollama). Budget your scans with --limit.

Quick setup (2 minutes)

Add one API key to .env:

Scan:

Done. The package uses whatever provider you configured in Laravel AI. Optionally override just for this package:

On sampling parameters. Scans run at a low fixed temperature for reproducibility, but Anthropic removed temperature from Claude Opus 4.7 onward — sending it to Opus 4.7/4.8, Opus 5, Sonnet 5 or Fable 5 returns HTTP 400. The scanner detects those models and omits the parameter, so they work out of the box; on those models reproducibility comes from the deterministic detection engine rather than from temperature.

Generate CTF challenges from real vulns

Train your team by turning actual findings into Capture The Flag exercises:

Each challenge outputs a ready-to-run directory: README, vulnerable code, solution, flag file, and docker-compose.

HTML reports, git-aware scanning, baselines

The HTML report is a single self-contained file — dark theme, animated score ring, collapsible cards, copy-paste code blocks, token usage breakdown. Professional enough to attach to a security audit.

--diff scans only what your PR touches. --update-baseline lets teams acknowledge known risks so CI doesn't fail on accepted findings.

Use it in code

Security

This package sends source code to AI providers. Files matching .env*, *.key, *.pem, and storage/logs/* are always excluded. Review your provider's data retention policies.

Found a vulnerability in this package? Email [email protected].

Contributing

PRs welcome. Run composer test and vendor/bin/pint before submitting.

License

MIT — LICENSE

If this saved you from getting hacked, star the repo.