nivoin/ship-ready

ShipReady

The most comprehensive static security, performance, and production-readiness auditor for Laravel 11, 12, and 13.

ShipReady runs 111 checks across 9 categories and catches what others miss: Octane memory leaks, multi-tenant data isolation failures, Livewire/Filament authorization gaps, Docker secrets baked into images, live CVEs from composer audit, and more — all without touching your database or making HTTP requests.

Use it as a Laravel production checklist, a CI quality gate, or an AI-powered fix engine via the built-in MCP server that lets Claude Code, Cursor, and GitHub Copilot audit and fix your app automatically.

  ShipReady Audit Report  v1.1.0

  Score  ████████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 18/100

  INFRASTRUCTURE
  ✖ CRITICAL [INF002] .env file is COPY'd into Docker image — secrets exposed
    Fix: Remove COPY .env. Pass secrets at runtime via env vars or secrets manager.
    Dockerfile

  OCTANE
  ✖ CRITICAL [OCT001] Singleton captures Request — Octane memory leak between requests
    Fix: Inject Request inside methods, never in singleton closures.
    app/Providers/AppServiceProvider.php

  SECURITY
  ✖ HIGH     [SEC001] APP_DEBUG is enabled in production. Stack traces exposed.
    Fix: Set APP_DEBUG=false in your production .env file.
  ✖ HIGH     [SEC019] Hardcoded Stripe secret key found in AdminController.php
    Fix: Move secrets to .env and access via config().
  ✖ HIGH     [SEC020] shell_exec() with user-controlled input — OS command injection
    Fix: Never pass unsanitised user input to shell functions.
    app/Http/Controllers/PostController.php:19
  ▲ MEDIUM   [SEC014] Missing security header: Strict-Transport-Security
    Fix: Add HSTS middleware or use spatie/laravel-csp.

  VERSION SPECIFIC
  ▲ MEDIUM   [VER001] CSRF exclusions in VerifyCsrfToken.php are ignored in Laravel 11+
    Fix: Move CSRF exclusions to bootstrap/app.php withMiddleware().
    app/Http/Middleware/VerifyCsrfToken.php

  Found 25 issue(s): 2 critical, 4 high, 5 medium, 14 low in 3.2s

Requirements

• PHP 8.2+
• Laravel 11, 12, or 13

Installation

composer require nivoin/ship-ready --dev

Laravel auto-discovers the service provider. No configuration publishing required.

Quick Start

# Full audit (production mode)
php artisan ship:check --target-env=production

# Security checks only
php artisan ship:check --category=security

# Fail CI on high+ severity only
php artisan ship:check --fail-on=high --ci

# Only check files changed since last commit
php artisan ship:check --changed=origin/main

# JSON output for tooling
php artisan ship:check --format=json --output=report.json

# SARIF for GitHub Code Scanning
php artisan ship:check --format=sarif --output=results.sarif

# Explain a specific check in detail
php artisan ship:explain SEC001

# Live HTTP security probe
php artisan ship:probe --url=https://your-app.com

# Check for env variable drift
php artisan ship:drift

# Route attack surface map
php artisan ship:routes

# Laravel 14 upgrade readiness
php artisan ship:next --target=14

# Generate CI/deploy gate
php artisan ship:install --workflow

Exit Codes

Default --fail-on is high. Override in config/ship-ready.php or via SHIP_READY_FAIL_ON=critical.

Versioning

ShipReady follows Semantic Versioning.

Commands

Options

Checks (111 total)

Security (32)

Performance (18)

Reliability (19)

Version-Specific (16)

Octane (6)

Queue (5)

Tenancy (6)

Packages (5)

Infrastructure (4)

AI Agent Integration (MCP)

ShipReady ships an MCP (Model Context Protocol) server that lets AI agents audit your app and suggest fixes without leaving the conversation.

Add to .mcp.json in your project root:

{
  "mcpServers": {
    "shipready": {
      "command": "php",
      "args": ["artisan", "ship:mcp"]
    }
  }
}

Tools exposed to the agent:

Environment Drift

# Compare .env against .env.example
php artisan ship:drift

# Compare staging vs production
php artisan ship:drift --from=.env.production --to=.env.staging

HTTP Probe

# Probe your production URL for header and path issues
php artisan ship:probe --url=https://your-app.com

Checks: HSTS, CSP, X-Frame-Options, cookie flags (HttpOnly, Secure, SameSite), X-Powered-By, and 7 sensitive paths (/.env, /.git/HEAD, /telescope, /horizon, etc.).

Baseline

Suppress known findings without fixing them:

# Save current findings as baseline
php artisan ship:baseline

# Remove fixed findings from baseline
php artisan ship:baseline --prune

Future runs only report new findings (--diff mode is automatic when a baseline exists).

Inline Suppression

// @ship-ignore SEC018 env() needed here for early boot
$value = env('APP_KEY');

Custom Checks

php artisan make:ship-check MyCustomCheck --category=security --severity=high

Place the generated class in app/ShipReady/ — it is auto-discovered on every run.

Configuration

php artisan vendor:publish --tag=ship-ready-config

Key options in config/ship-ready.php:

CI — GitHub Actions

- name: Run ShipReady
  run: php artisan ship:check --target-env=production --fail-on=high --format=github --ci

Upload SARIF to GitHub Code Scanning:

- name: Run ShipReady
  run: php artisan ship:check --format=sarif --output=results.sarif --fail-on=critical

- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif

Generate the workflow automatically:

php artisan ship:install --workflow

What ShipReady gives you

Contributing

Bug reports and pull requests are welcome on GitHub.

License

MIT — see LICENSE