Purpose-scoped, hashed, rate-limited one-time passwords for Laravel.

Password policy and lifecycle for Laravel: extended validation rule, blocklists, reuse prevention, expiration, compromise detection and notifications.

رمزگذاری امن سورس‌کد PHP در پروژه‌های Laravel/Lumen با مدیریت کلید مبتنی بر Master Key + HKDF

Password rotation for any Laravel app (no admin panel required): force any authenticatable to rotate its password every N days, with reuse prevention, a first-login gate, expiry warnings and a redirect middleware.

SSRF prevention for Laravel. Protect Http::, Guzzle, and validate user-supplied URLs against server-side request forgery.

Device management, logout other devices and new-device alerts for Laravel — without giving up your cache-based session driver.

PURL to CPE conversion for Laravel, backed by the curated scanoss/purl2cpe database. Ships ~47k reduced mappings so you can resolve NVD CPEs for a Package URL out of the box.

Package URL (purl) for Laravel — parse, build, normalize and validate purls per the spec, plus registry/repository/download URL resolution, ecosystem mapping, and CPE-friendly helpers.

Intelligent Adaptive Rate Limiter & Security Shield for Laravel - Advanced threat detection, behavioral analysis, fingerprinting, and auto-hardening protection.

Multi-Factor Authentication package for Laravel with TOTP, Email OTP, and WebAuthn support

Cbox Risk — an explainable, config-driven request risk-scoring pipeline for Laravel. Weights signals (IP reputation, geo, disposable email, velocity, bot timing) into a score and an outcome: allow, challenge, step-up, or reject.

Cbox SSRF — a hardened, config-driven guard against server-side request forgery for outbound URLs in Laravel. Blocks private/reserved/cloud-metadata targets, pins DNS, and refuses redirects.

AI-powered code analysis, security auditing, and health reporting for Laravel applications

Fingerprint, browser tracking and lightweight page movement tracking for Laravel.

An abuse firewall for AI endpoints: detect runaway agent loops within a request, and open a circuit on a per-tenant spend anomaly, before a self-recursing agent drains the API budget. Security-framed, not just rate limiting.

Static analysis for insecure AI wiring in Laravel apps: a scan command that finds AI provider keys leaked into tracked or client-reachable files, plus PHPStan rules that flag model output flowing into unsafe sinks and prompts built by concatenation. SARIF for CI.

Scan, redact, and optionally block outbound requests to AI providers (OpenAI, Anthropic, Gemini, and more) for leaked secrets and PII. Review in an inbox and fail CI before a prompt leaks. SDK-agnostic, at the HTTP layer.

Securely assume another user's identity in modern Laravel applications.

Framework-agnostic secret and PII detection engine: rules, scanner, redactor, severity and confidence model. Shared core for the Laravel Security Audit guard packages.

Scan outgoing Laravel mail for leaked secrets, PII, and compliance issues. Preview, block unsafe sends, and fail CI before email leaks.

VPN, proxy and Tor detection middleware for Laravel, powered by the IP2Proxy database.

Secure file upload validation for Laravel — fail-closed scanning for polyglot web shells, malicious PDFs/SVGs, zip bombs, Office macros, and spoofed MIME types.

Laravel plugin of the mindtwo monitoring suite: framework-specific collectors, a scheduled push job and a signed pull endpoint on top of mindtwo/base-monitoring.

Map Laravel code evidence to security requirements and generate compliance reports.

Professional Laravel package for secure encryption with Strategy Pattern, SOLID principles, and modern PHP 8.2+ features

Laravel integration for Unbotable — privacy-respecting bot and spam protection

Laravel package to detect malicious IPs, ban them via Cloudflare, and report to AbuseIPDB

High-signal health checks for Laravel apps. Run php artisan doctor to catch deploy blockers, security drift, and production footguns.

Secure encrypted Eloquent model fields for sensitive data in Laravel applications.

Meta-package for the padosoft/laravel-rebel-* enterprise authentication control plane: passwordless email-OTP, passkey-first, risk-based step-up with PSD2/SCA, channels, sessions, recovery, anomaly detection and a web admin panel — installs and ties the whole suite together.

Anomaly detection + AI security copilot for Laravel Rebel: deterministic rules detect anomaly cases; the optional AI only explains/suggests (sanitized prompts, no PII/OTP, human review). Part of padosoft/laravel-rebel-*.

High-assurance account recovery for Laravel Rebel: single-use HMAC-hashed recovery (backup) codes, generated once at enrolment, with anti-ATO checks. Part of padosoft/laravel-rebel-*.

Device/session registry for Laravel Rebel: session/device tracking, logout-everywhere, refresh-token rotation with reuse detection, and device trust. Part of padosoft/laravel-rebel-*.

Control-plane JSON API for Laravel Rebel: security metrics, audit-event explorer, OTP/step-up funnels, provider health, with permission-gated and tenant-scoped read models. Part of padosoft/laravel-rebel-*.

Channel/provider abstraction (SMS/WhatsApp/voice) for Laravel Rebel: verification routing with fallback, cooldown, multi-dimensional rate limiting, and anti toll-fraud/IRSF defences. Part of padosoft/laravel-rebel-*.

Web Admin Panel (Blade + AJAX + vanilla JS) for Laravel Rebel: a security operations dashboard over the Rebel Admin API. Part of padosoft/laravel-rebel-*.

Core primitives, value objects and contracts for Laravel Rebel: the enterprise authentication control plane (AAL/AMR assurance, security context, audit, Sanctum tokens, rate-limiting). The entry point of the padosoft/laravel-rebel-* ecosystem.

Auditor determinista para codebases Laravel: seguridad, performance, Eloquent y arquitectura.

Signed, timestamped, replay-protected and optionally AES-256-GCM-encrypted request/response bridge between a JavaScript front-end (SPA or Blade + AJAX) and a Laravel API. Framework-agnostic JS client. Works on Laravel 5.5 through 12 and PHP 7.1+.

Device-bound login sessions for Laravel: per-device remember-me tokens, a "where am I signed in" device list, and revoke/rename — privacy-respecting and Fortify-agnostic.

Filesystem intrusion evidence scanner for Laravel applications

Audit a Laravel project's Composer dependencies for upgrade safety, security, and Laravel compatibility.

Encrypt sensitive Laravel route parameters with Crypt and decrypt them before implicit binding.

Laravel-aware security rules for php-security-scanner. Detects Laravel SQL injection (DB::raw, whereRaw), mass assignment, debug/dd leaks, unsafe validators, CSRF bypass, insecure cookies, env exposure, Blade raw echo, open redirect, Http SSRF, Storage/File path traversal, file-upload validation gaps, Auth/Crypt/Artisan/Process/Config injection, view-name injection, session fixation, and Mail header injection.

SOCWarden security observability SDK for Laravel — detect brute force, impossible travel, credential spray, and more from one API call.

Protected super admin account for Laravel. Zero-config authorization via Gate::before, defense-in-depth Eloquent observer, optional Filament v4 plugin, vendor-only CLI commands with friction controls. Designed for vendor-deployed applications where customer admins must not accidentally delete the vendor's support account.

Agentic Governance Layer for Laravel 13

A Laravel package for website health monitoring, IP threat detection, traffic analysis and auto-banning.

Kanbino Health endpoint for Laravel — emits stack profile + extensible probes for uptime + security advisory matching

Laravel wrapper for voku/anti-xss — Facade, service, validation rule, middleware and Blade directive to sanitize XSS in strings.