README

Automatically scan your Laravel project for common security vulnerabilities in .env and configuration files.
Detect unsafe values, missing keys, and misconfigured HTTPS, CORS, and cookie settings — directly from your CLI.

Contents

• Features
• Installation
• Usage
• What It Checks
• Markdown Report Example
• Configuration
• CI/CD Integration Example
• Compatibility
• Support & Sponsorship
• About the Author
• License

🚀 Features

✅ Detects risky environment variables (APP_DEBUG=true, missing APP_KEY, etc.)
✅ Scans for insecure configuration values (CORS *, SESSION_SECURE=false, QUEUE=sync, etc.)
✅ Validates HTTPS usage in URLs and cookies
✅ Generates CLI or Markdown reports for CI/CD pipelines
✅ Includes strict mode (--strict) for automated fail conditions in CI
✅ Lightweight and dependency-free — works out of the box

📦 Installation

composer require fragly/laravel-security-tools --dev

Laravel will auto-discover the service provider.

Alternatively, you can register it manually in config/app.php:

'providers' => [
    Fragly\SecurityTools\SecurityToolsServiceProvider::class,
],

⚙️ Usage

Run a full scan

php artisan security:scan

Generate Markdown report (for CI or audit logs)

php artisan security:scan --format=md

Output file (by default): storage/logs/security-report.md

Strict mode (fail build on warnings)

php artisan security:scan --strict

🧠 What It Checks

Environment (.env)

Config Checks (config())

🧾 Markdown Report Example

When you run:

php artisan security:scan --format=md

It generates:

Laravel Security Tools Report

• Generated at: 2025-10-25 03:00:00

⚡ Configuration

You can publish the config file to customize checks:

Config file: config/security-tools.php

🧪 CI/CD Integration Example

GitHub Actions

on: [push, pull_request]

jobs:
security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install dependencies
run: composer install --no-interaction --prefer-dist
- name: Run security scan
run: php artisan security:scan --strict

🧩 Compatibility

- Laravel: 9.x – 12.x

- PHP: >=8.2

❤️ Support & Sponsorship

If you like this package, you can support its development and get access to exclusive Laravel & Next.js dev tools:

Support on Patreon

🎁 Get early access to private packages, beta features, and developer insights.

Or buy me a coffee ☕

🧑‍💻 About the Author

Fragly Dev — Building tools for modern Laravel & Next.js developers.

Follow for more developer utilities, security helpers, and SaaS-ready boilerplates.

GitHub

Patreon

Website

🪪 License

This package is open-sourced software licensed under the MIT license.

Made with ❤️ by Fragly Dev — making Laravel projects safer by default.