Security scanner for Laravel 12 & 13, and standalone for Symfony, Yii2 and plain PHP: AST taint analysis of your code, React/Vue/Angular frontend, Docker, CI and shell script checks, checks of the booted app's config and routes, OSV dependency advisories, baselines and SARIF output.

Laravel-aware security rules for php-security-scanner. Detects Laravel SQL injection (DB::raw, whereRaw), mass assignment, debug/dd leaks, unsafe validators, CSRF bypass, insecure cookies, env exposure, Blade raw echo, open redirect, Http SSRF, Storage/File path traversal, file-upload validation gaps, Auth/Crypt/Artisan/Process/Config injection, view-name injection, session fixation, and Mail header injection.