Libraries tagged by security patch

Framework-agnostic static security scanner for PHP. Detects SQLi, XSS, command injection, path traversal, insecure deserialization, weak crypto, hardcoded secrets, and more.

Go to Download

Laravel-aware security rules for php-security-scanner. Detects Laravel SQL injection (DB::raw, whereRaw), mass assignment, debug/dd leaks, unsafe validators, CSRF bypass, insecure cookies, env exposure, Blade raw echo, open redirect, Http SSRF, Storage/File path traversal, file-upload validation gaps, Auth/Crypt/Artisan/Process/Config injection, view-name injection, session fixation, and Mail header injection.

Go to Download

Reusable intrusion defence package for Laravel: known attack path detection, permanent IP blocking, public rate limiting, admin IP allowlists, one-time submission tokens and hardened security notifications.

Go to Download

First-party PDF reader, writer and renderer for agentic docs, in pure PHP with zero runtime dependencies. Writes PDF 1.7 from the last-word JSON document model and never writes active content. Parses PDFs, extracts text in reading order, reports active content without executing it, and guards agent reads against prompt injection. Renders vector paths, TrueType text, sampled images and baseline JPEG to PNG. Hostile-input limits refuse bombs, cycles and oversized images cleanly; unsupported content is reported.

Go to Download

Headless manager for the well-known files every modern web app owes bots AND agents — robots.txt, .well-known/security.txt, llms.txt, humans.txt, sitemap.xml, and an agents/AI manifest. Define them once in code/config and serve them consistently. Zero runtime deps; ships a default-open robots evaluator so scrapers can honor robots honestly, and makes it hard to leak a protected path. Framework-agnostic core + Laravel adapter.

Go to Download

Laravel Session theft protection via client fingerprinting — auto-invalidates sessions used from unrecognized devices.

Go to Download

Безопасная работа с файловой системой для PHP 8.1+: атомарная запись (случайный temp + rename), потоковое и ленивое чтение, символические/жёсткие ссылки, JSON, рекурсивные операции с каталогами, glob, временные пути и лексические операции с путями с защитой от path traversal. Суперсет возможностей Symfony/Flysystem/Laravel/Nette при нулевых внешних зависимостях кроме ext-fileinfo.

Go to Download

Complete path management solution for PHP applications with zero dependencies, built-in filesystem operations, enhanced security, framework presets (Laravel, Slim4, Mezzio), and comprehensive validation

Go to Download

A library to normalize paths and prevent directory traversal.

Go to Download

file-tool-security-policy

Go to Download

Shared sandbox contracts and value objects for file-based tools.

Go to Download

PHP library to mask (redact) credit card numbers, emails and more.

Go to Download

Identifies which packages restrains you from upgrading to a newer framework version.

Go to Download

Sylius integration for Calmfox Watch (https://watch.calmfox.net), a website monitoring service that scores site health from 0 to 100 (availability, security, updates, content, performance). Adds a secret health endpoint with service status (database, disk, mail, queues, cache, checkout path, scheduled jobs), basic security hygiene checks and a package version history.

Go to Download

Magento 2 integration for Calmfox Watch (https://watch.calmfox.net), a website monitoring service that scores site health from 0 to 100 (availability, security, updates, content, performance). Adds a secret health endpoint with service status (database, disk, mail, cron, indexers, cache, checkout path, search engine), basic security hygiene checks and a package version history.

Go to Download