| Install | |
|---|---|
composer require artflow-studio/laravel-security |
|
| Latest Version: | 0.1.4 |
| PHP: | * |
The Ultimate All-in-One Security Scanner for Laravel & Livewire Applications
A comprehensive, enterprise-grade security vulnerability scanner that detects security issues, performance bottlenecks, misconfigurations, and potential exploits before they become problems. Built specifically for Laravel 11/12 and Livewire 3 applications with intelligent auto-fix capabilities.
Require the package via Composer:
composer require artflow-studio/laravel-security --dev
The package will automatically register its service provider.
php artisan vendor:publish --tag=scanner-config
This creates config/laravel-security.php where you can customize the scanner behavior.
Run the interactive scanner to select which checks to perform:
php artisan scan
This presents a beautiful menu to choose from 17 scanners with real-time progress updates.
Run all 17 scanners at once:
php artisan scan --all
Run specific scanners for targeted analysis:
# Core Security Scanners
php artisan scan:livewire # Livewire component security
php artisan scan:security # XSS, SQL Injection, CSRF, dangerous functions
php artisan scan:rate-limit # Rate limiting on routes
php artisan scan:authentication # Auth & session security
php artisan scan:dependencies # Outdated/vulnerable packages
php artisan scan:configuration # Laravel configuration issues
# NEW: Advanced Scanners
php artisan scan:cors # CORS & HTTP security headers
php artisan scan:route # Route security, closures, middleware
php artisan scan:vendor # Deep vendor folder analysis
php artisan scan:performance # N+1 queries, memory issues
# All scanners support JSON output
php artisan scan:cors --json
php artisan scan:performance --json
Automatically fix detected issues with intelligent repair strategies:
# Dry-run mode (preview changes without applying)
php artisan scan:fix --dry-run
# Fix specific scanner issues
php artisan scan:fix --scanner=livewire --dry-run
# Fix specific vulnerability type
php artisan scan:fix --type=public_property_no_validation --dry-run
# Auto-fix with backup (recommended for first run)
php artisan scan:fix --backup --auto
# Interactive mode (asks for confirmation)
php artisan scan:fix
Auto-Fix Capabilities:
Create detailed reports in multiple formats:
# JSON report (CI/CD integration)
php artisan scan:report json --output=security-report.json
# HTML report (beautiful, shareable)
php artisan scan:report html --output=security-report.html
# Markdown report (documentation)
php artisan scan:report markdown --output=security-report.md
# Run specific scanners only
php artisan scan:report html --scanners=livewire,cors,performance --output=report.html
# Full report with all 17 scanners
php artisan scan:report html --output=complete-audit.html
╔══════════════════════════════════════════════════════════════╗
║ Artflow Vulnerability Scanner v1.0.0 ║
╚══════════════════════════════════════════════════════════════╝
🔍 Route & Endpoint Security Scanner
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Checks route closures, middleware, authorization, rate limiting
Found 64 issue(s):
� Issue Types:
• Missing Role Middleware: 17
• Missing Csrf: 14
• Route Param No Validation: 14
• Missing Rate Limiting: 8
• Route Closure: 6
�🔴 [CRITICAL] Admin Route Without Authentication
📁 File: routes/web.php
📝 Issue: Route 'accounts/dashboard' lacks 'auth' middleware
💡 Fix: Add auth middleware: Route::middleware(['auth'])->group(...)
🟠 [HIGH] Route Closure Detected
📁 File: routes/web.php:45
📝 Issue: Route uses closure, preventing route caching
💻 Code: Route::get('/', function () {
💡 Fix: Convert to controller: Route::get('/', [HomeController::class, 'index'])
╔══════════════════════════════════════════════════════════════╗
║ SUMMARY ║
╚══════════════════════════════════════════════════════════════╝
Total Vulnerabilities: 64
Files Scanned: 5
Severity Breakdown:
🔴 Critical: 3
🟠 High: 39
🟡 Medium: 22
🔵 Low: 0
🟢 Info: 0
{
"scanner_name": "Performance & Scalability Scanner",
"total_vulnerabilities": 79,
"severity_counts": {
"critical": 6,
"high": 5,
"medium": 32,
"info": 36
},
"files_scanned": 187,
"scan_time": 0.234,
"vulnerabilities": [
{
"title": "Database Query Inside Loop",
"severity": "critical",
"file": "app/Http/Controllers/AccountFlow/AccountsController.php",
"line": 60,
"type": "query_in_loop",
"recommendation": "Move query outside loop and use eager loading"
}
]
}
Comprehensive CORS and security headers analysis:
Deep route analysis for security gaps:
Complete vendor folder security audit:
Detect performance bottlenecks:
50+ specialized Livewire 3 security checks:
Publish and customize the configuration file:
php artisan vendor:publish --tag=scanner-config
Available Configuration Options:
// config/laravel-security.php
return [
'paths' => [
'scan' => ['app', 'routes', 'config'],
'exclude' => ['vendor', 'node_modules', 'storage'],
],
'severity_threshold' => 'medium', // Only report medium and above
'scanners' => [
'enabled' => ['livewire', 'xss', 'cors', 'performance'], // Choose scanners
'disabled' => [],
],
'auto_fix' => [
'enabled' => true,
'backup' => true,
'strategies' => ['todo-comment', 'authorization'],
],
'reports' => [
'default_format' => 'console',
'output_path' => storage_path('scanner'),
],
];
Based on testing with production Laravel applications:
| Scanner | Typical Findings | Impact |
|---|---|---|
| Livewire | 200+ public properties without validation | 🔴 Critical |
| Route Security | 64 missing auth/middleware issues | 🔴 Critical |
| Performance | 79 N+1 queries and memory issues | 🟠 High |
| CORS | 3 missing security headers | 🟡 Medium |
| Vendor | 4 unsafe dependencies | 🟠 High |
| XSS | 50+ unescaped outputs | 🔴 Critical |
Average per project: 400+ security & performance issues detected
Want a feature? Open an issue or submit a PR!
We welcome contributions! Areas where you can help:
Found a bug or have an idea? Open an issue
# Run package tests
composer test
# Run with coverage
composer test-coverage
# Static analysis
composer analyse
✅ Most Comprehensive - 17 specialized scanners vs typical 5-8
✅ Laravel Native - Built specifically for Laravel/Livewire
✅ Auto-Fix Capability - Actually fixes issues, not just reports
✅ Production Tested - Battle-tested on enterprise applications
✅ Active Development - Regular updates and new features
✅ Zero Config - Works out of the box, customize if needed
✅ Performance Focused - Fast static analysis, no runtime overhead
✅ Beautiful Output - Color-coded, organized, actionable reports
The MIT License (MIT). Please see License File for more information.
Built with ❤️ by Artflow Studio
Special thanks to:
Secure your Laravel application today!
composer require artflow-studio/laravel-security --dev
php artisan scan
Star ⭐ this repo if you find it useful!