- How do I install dgtlss/warden in a Laravel application?
- Install Warden as a dev-only Composer dependency with composer require --dev dgtlss/warden, then run the warden:audit Artisan command from your Laravel application. Review any generated GitHub or GitLab workflow files before committing them, and publish or adjust configuration only as needed for your environment. The package is designed to run wherever PHP CLI runs, so local and CI usage follow the same command path.
- Which Laravel and PHP versions does Warden support?
- This line supports PHP 8.3 through 8.5 and Laravel 12 through 13. Applications still on Laravel 10 or 11 cannot adopt this release line directly and need a separately pinned version or an exclusion from rollout. Treat portfolio adoption as a per-application decision rather than a single global upgrade.
- What does the warden:audit command actually check?
- Warden runs configurable security audits against your Laravel application and flags common misconfigurations, exposed files, risky settings, and hidden-file credential patterns such as committed example or GitHub configuration files. The package overview also describes dependency vulnerability monitoring through automated Composer audits. Because stricter releases expand detection, expect some new findings in example and configuration files after adoption.
- What report formats can Warden output for CI pipelines?
- Warden can produce multiple reports from a single timestamped, gated scan, including default JSON 2.0.0, opt-in json-v2.1 with gate and coverage fields, SARIF 2.1.0, JUnit, GitHub annotations, GitLab dependency scanning 15.2.4, and baseline 1.0.0. Report schema versions are decoupled from the package version, so track both during upgrades. Existing downstream consumers of the default JSON contract should keep working through the 2.2 bump.
- How do I integrate Warden with GitHub Actions or GitLab CI?
- Warden generates GitHub and GitLab workflow files that reduce setup to reviewing a diff, and generated GitLab jobs preserve your existing stages. Use the gating option such as --fail-on in CI when you want non-zero builds for policy violations. Also set artifact retention deliberately because SARIF and JSON reports can contain file paths and code snippets.
- How does Warden handle suppressions and baselines?
- Baselines use schema 1.0.0 and suppressions are validated before scanning. Malformed fingerprints that are not lowercase SHA-256 values and invalid expiry dates cause exit code 2 before any scan, so hand-edited or script-generated suppression files can break the pipeline. Fingerprint and baseline stability is claimed for unchanged source, but validate that against your own codebase before relying on it.
- Can Warden send notifications through email or webhooks?
- Yes. The package overview describes webhook and email notifications for audit results, and legacy findings-only notification channel methods remain available so existing custom channel integrations do not require an immediate rewrite. Configure notification destinations and secrets through your Laravel configuration and CI environment. Confirm channel behavior in your installed version before replacing existing alerting.
- Is Warden safe to run in production environments?
- Warden is a dev-only Composer package with no runtime dependency, service, or data plane, so it is intended for local tooling and CI rather than production request handling. Be careful with generated artifacts: SARIF and JSON reports routinely include file paths and code snippets, so apply retention and access controls. The provided materials do not confirm telemetry behavior, so review source and configuration before use in regulated environments.
- Will upgrading to Warden 2.2 cause new findings or failed builds?
- Upgrading to 2.2 can surface findings that were previously masked because sanitizers are scoped to their corresponding sink and aliases, typed Request parameters, and named arguments are resolved. Teams gating builds with --fail-on should expect red builds on upgrade day even without code changes. Validate fingerprint and baseline stability on your codebase, then triage or allowlist new findings deliberately.
- What are alternatives to Warden for Laravel security scanning?
- Warden sits in the SAST and secret-scanning layer and is adjacent to, not a replacement for, composer audit, Dependabot, and platform-level code scanning. Use it when you want Laravel-aware Artisan reports and CI-friendly JSON, SARIF, JUnit, GitHub, or GitLab outputs. Many teams combine it with dependency monitoring and repository scanning rather than choosing only one tool.