README

Enterprise-grade runtime security inspection for Laravel applications.

RuntimeGuard provides a comprehensive, extensible framework for runtime security monitoring. Unlike static analyzers, it inspects actual data flowing through your application in real-time, detecting threats before they can cause damage.

Table of Contents

• Laravel RuntimeGuard
  • Table of Contents
  • Features
    • Security Guards
    • Performance
    • Enterprise Features
  • Requirements
  • Installation
  • Quick Start
    • Basic Usage
    • Controller Trait
    • PHP Attributes
  • Configuration
  • Security Guards
  • Middleware Usage
  • Artisan Commands
  • Testing
  • Documentation
  • Contributing
  • Security
  • Credits
  • License

Features

Security Guards

• SQL Injection — UNION attacks, boolean-based, time-based, stacked queries
• XSS Detection — Script tags, event handlers, DOM-based XSS, encoded payloads
• Command Injection — Shell metacharacters, command chaining, path traversal
• SSRF Protection — Internal IPs, cloud metadata endpoints, DNS rebinding
• NoSQL Injection — MongoDB operators, JSON-encoded attacks
• Mass Assignment — Dangerous field protection
• GraphQL Security — Query depth limits, complexity analysis
• JWT/Token Abuse — Algorithm confusion, replay attacks, JKU injection
• Bot Detection — Behavioral analysis, honeypot integration
• Session Integrity — Fingerprint drift, geolocation jumps

Performance

• Tiered inspection (quick scan + deep analysis)
• LRU deduplication cache
• Request sampling
• Bloom filter pre-screening
• Lazy guard resolution
• Streaming inspection for large payloads
• Async guard execution with PHP Fibers

Enterprise Features

• ML-powered anomaly detection
• Multi-tenant security isolation
• Real-time metrics (Prometheus-compatible)
• SIEM integration (Splunk, ELK, Datadog)
• WAF rule export (AWS WAF, Cloudflare, ModSecurity)
• Threat intelligence feeds
• Compliance reporting (PCI-DSS, OWASP Top 10)

Requirements

• PHP 8.1+
• Laravel 10.0+ or 11.0+

Installation

composer require m9nx/laravel-runtime-guard

Publish the configuration:

php artisan vendor:publish --tag=runtime-guard-config

For database reporting (optional):

php artisan vendor:publish --tag=runtime-guard-migrations
php artisan migrate

Quick Start

Basic Usage

use M9nx\RuntimeGuard\Facades\RuntimeGuard;

// Inspect input with all enabled guards
$results = RuntimeGuard::inspect($userInput);

// Check if threat was detected
if ($results->hasThreat()) {
    Log::warning('Threat detected', [
        'level' => $results->getHighestThreatLevel()->value,
        'guards' => $results->getTriggeredGuards(),
    ]);
}

// Inspect with a specific guard
$result = RuntimeGuard::inspectWith('sql-injection', $userInput);

Controller Trait

use M9nx\RuntimeGuard\Traits\InspectsInput;

class FormController extends Controller
{
    use InspectsInput;

    public function submit(Request $request)
    {
        $this->inspectRequest($request);
        
        // Or inspect specific fields only
        $this->inspectRequestFields(['name', 'email', 'message']);
    }
}

PHP Attributes

use M9nx\RuntimeGuard\Attributes\GuardProfile;
use M9nx\RuntimeGuard\Attributes\SkipGuard;

class AdminController extends Controller
{
    #[GuardProfile('admin')]
    public function sensitiveAction()
    {
        // Uses 'admin' profile with stricter rules
    }

    #[SkipGuard(['xss'])]
    public function richTextEditor()
    {
        // XSS guard skipped for this endpoint
    }
}

Configuration

// config/runtime-guard.php

return [
    'enabled' => env('RUNTIME_GUARD_ENABLED', true),
    'mode' => env('RUNTIME_GUARD_MODE', 'log'), // 'block', 'log', 'silent'
    
    'pipeline' => [
        'strategy' => 'short_circuit', // 'full', 'short_circuit', 'threshold'
        'tiered' => true,
    ],

    'guards' => [
        'sql-injection' => ['enabled' => true, 'priority' => 100],
        'xss' => ['enabled' => true, 'priority' => 90],
        'command-injection' => ['enabled' => true, 'priority' => 95],
        // ... more guards
    ],

    'profiles' => [
        'api' => [
            'guards' => ['sql-injection', 'command-injection'],
            'mode' => 'log',
        ],
        'admin' => [
            'guards' => '*',
            'mode' => 'block',
        ],
    ],
];

Security Guards

Middleware Usage

// routes/web.php

// Apply to specific routes
Route::middleware(['runtime-guard'])->group(function () {
    Route::post('/submit', [FormController::class, 'submit']);
});

// With a specific profile
Route::middleware(['runtime-guard:admin'])->group(function () {
    Route::resource('/admin/users', AdminUserController::class);
});

Artisan Commands

# List all registered guards
php artisan runtime-guard:list

# Test a guard with sample input
php artisan runtime-guard:test sql-injection "1' OR '1'='1"

# Check system status
php artisan runtime-guard:status

# Toggle guards at runtime
php artisan runtime-guard:toggle sql-injection --disable

# Generate a new custom guard
php artisan runtime-guard:make-guard CustomGuard

# Run security audit
php artisan runtime-guard:security-audit

Testing

RuntimeGuard provides testing utilities for your application tests:

use M9nx\RuntimeGuard\Facades\RuntimeGuard;

class SecurityTest extends TestCase
{
    public function test_sql_injection_is_detected(): void
    {
        $fake = RuntimeGuard::fake();
        
        $this->post('/api/search', ['query' => "1' OR '1'='1"]);
        
        $fake->assertThreatDetected();
        $fake->assertGuardTriggered('sql-injection');
    }

    public function test_clean_input_passes(): void
    {
        $fake = RuntimeGuard::fake();
        
        $this->post('/api/search', ['query' => 'normal search']);
        
        $fake->assertNoThreatsDetected();
    }
}

Documentation

Contributing

Contributions are welcome! Please see CONTRIBUTING.md for details.

# Development setup
composer install
composer test
composer analyse

Security

If you discover a security vulnerability, please send an email to the maintainer instead of using the issue tracker. See SECURITY.md for details.

Credits

• M9nx
• All Contributors

License

The MIT License (MIT). See LICENSE for more information.