mrpunyapal/laravel-auditor/laravel-audit-security

Laravel Security Audit

Audit the security boundaries of the Laravel application. Do not invent vulnerabilities merely because a pattern is uncommon. Require context and evidence.

List applicable rules first:

php artisan auditor:rules --domain=security --applicable

What to look for

• Authorization gaps: routes/controllers that mutate or expose resources without a policy, gate, or middleware.
• Insecure resource access: missing ownership checks on update/delete/show.
• Missing policies/gates where the app has clear resource ownership.
• Mass assignment risks: unguarded models or over-permissive $fillable combined with direct request input.
• Unsafe validation assumptions: trusting required/client-side checks, missing server-side validation on critical fields.
• Sensitive data exposure: secrets or personal data in responses, logs, exceptions, or dumps.
• Unsafe configuration usage: APP_DEBUG assumptions, hardcoded credentials, env values echoed.
• Dangerous file handling: unvalidated uploads, paths from user input, unsafe file reads.
• Unsafe URL/redirect handling: open redirects from user-controlled targets.
• SSRF (AUD-SEC-014): trace untrusted URLs into Http/Guzzle/cURL, including DNS resolution and redirects; verify the effective destination restrictions before reporting.
• Insecure authentication/authorization patterns: storing secrets in plaintext, weak session config, missing rate limits on auth.
• Secrets accidentally committed or exposed where detectable (.env committed, keys in source).
• Weak or missing CSRF protection: VerifyCsrfToken::except whitelists, removed/reordered CSRF middleware, forms or post endpoints missing the token.
• Webhook authenticity (AUD-SEC-016): a CSRF-exempt webhook is not inherently unsafe; follow provider signature, secret, or equivalent authentication checks through middleware before concluding that events can be forged.
• Unescaped output / XSS risk: Blade {!! !!}, ->get(), ->toHtml() rendering user-controlled or stored data.
• Raw SQL with user-controlled input: DB::raw, whereRaw, selectRaw, orderByRaw, or statement interpolating request input.
• Known vulnerable dependencies. Inspect composer_audit.advisories, ignored_advisories, abandoned, filter (which may include malware lists), and cooldown independently. A non-empty unreachable_repositories list means results are incomplete, even if no advisories were reported. dependencies.composer_audit is on by default. Use it for AUD-DEP-001 when available is true. If available is false, read reason or run composer audit --format=json yourself — do not treat an empty payload as “no advisories”. Set laravel-auditor.context.composer_audit to false only when you need to skip the shell-out.
• Command injection (AUD-SEC-015): trace request/job/file data into shell invocation sinks and establish whether it enters a shell command or a safely separated argument array.
• Known vulnerable production npm dependencies when context.npm_audit is enabled. Use dependencies.npm_audit for AUD-DEP-007; an unavailable scan must not be reported as clean.
• Queued jobs that serialize Eloquent models with hidden/sensitive attributes (AUD-QUE-002).

When these packages are installed, also apply their packs (auditor:rules --applicable): Livewire (AUD-LW-*), Filament (AUD-FIL-*), Inertia (AUD-IN-*), Sanctum (AUD-API-*).

Dependency-only export

For Composer advisory findings without an AI agent, run php artisan auditor:dependency-findings --output=storage/dependency-findings.json, then use that file with auditor:report or auditor:ci. Add --include-abandoned for low-severity maintenance findings. Keep this output separate from agent-produced findings; the command replaces the output file and fails on unavailable or incomplete audits. Confirmed dependency matches do not prove application exploitability. Ignored advisories, filters, cooldown entries, and npm results still require separate investigation.

Set context.composer_audit_locked for exact lockfile auditing and context.composer_audit_no_dev for production-only scope; both default to false. Optional context.npm_audit also defaults to false and requires npm 7+ with an npm lockfile. Never run an install, update, or audit fix as part of gathering audit evidence.

Evidence requirements

Every security finding needs at least:

• The specific route/controller/model file and line/range.
• The relevant middleware/policy/gate (or the absence of one).
• What the attacker-controlled input is, when applicable.

False positives

• Do not claim exploitability without sufficient evidence.
• A missing policy is only a finding when the resource is user-accessible or sensitive.
• Uncommon patterns are not automatically vulnerabilities.
• An empty composer_audit payload is not evidence that there are no advisories unless the check actually ran.

Severity guidance

• critical: directly exploitable, e.g. unauthenticated access to sensitive data or arbitrary code execution.
• high: requires a real but plausible precondition (e.g. any authenticated user).
• medium/low: defense-in-depth issues, configuration concerns, or low-exploitability risks.
• info: observations worth documenting without immediate risk.