- How do I install laravel-security-check in a Laravel project?
- Install it with Composer as a development dependency: composer require --dev leonardolima/laravel-security-check. Laravel's package auto-discovery registers the service provider, so its Artisan commands are available right after installation with no migrations or manual wiring. Run php artisan list to confirm the exact command name it registers in your version, then execute the audit against your project.
- What does laravel-security-check actually check?
- It is a static configuration linter rather than a runtime firewall or vulnerability scanner. Expect it to inspect config files and .env values for issues such as APP_DEBUG left on, a missing or weak APP_KEY, APP_ENV set incorrectly, session and cookie flags like secure, http_only and same_site, HTTPS and APP_URL consistency, and risky driver or debug-tooling choices. The precise checklist is defined by the package itself, so read the source or docs and version-pin the release you audit against.
- Can I run laravel-security-check in CI to fail the build?
- Yes in principle, since it runs as a console command in the same context as PHPUnit, Pint or PHPStan, so it slots into an existing pipeline step. Before making it a hard gate, confirm that the command returns a stable, documented nonzero exit code on failure and whether it offers a report-only mode or severity threshold. Many teams start with report-only output for a week, triage the findings, and only then promote it to a blocking check.
- Which Laravel versions does laravel-security-check support?
- The supported range is declared in the package's composer.json illuminate/support constraint, so check that file against your application's Laravel major before adopting it. Configuration defaults have shifted across Laravel majors, particularly around encryption, session and proxy handling, which means an opinionated checklist can encode guidance that is stale for your version. Verify the checks still match current Laravel recommendations rather than assuming parity.
- Does laravel-security-check replace composer audit or a real vulnerability scanner?
- No. It checks how your application is configured, while composer audit and tools like Dependabot or the Roave security-advisories feed check whether the packages you depend on have known CVEs. Those are complementary layers: a clean config report says nothing about a vulnerable dependency, and a clean dependency scan says nothing about APP_DEBUG being enabled. Treat this package as an additional pre-deploy checklist, not a substitute for SAST, secret scanning or penetration testing.
- Does laravel-security-check read my .env file and could it leak secrets into build logs?
- It inspects .env and config values, so it necessarily reads sensitive settings such as APP_KEY, database credentials or mail passwords. Before running it in CI, confirm how findings are printed and whether values are redacted or truncated in the output. Enable log masking for your CI provider's secret variables and avoid running the command with verbose or debug output in shared build logs.
- Should laravel-security-check be installed in production or only as a dev dependency?
- Install it with --dev. The package adds no middleware, routes or runtime behaviour, and its value comes from being run as a pre-deploy or CI check rather than from shipping in the production container. Keeping it out of the production autoload set reduces supply-chain surface for a package that has a single maintainer and no downstream dependents.
- How do I handle false positives from laravel-security-check?
- False positives are common because multi-tenant apps, queue workers and read replicas legitimately deviate from a single canonical baseline. Run the audit report-only first, then triage each finding into genuine issues to fix, accepted risks with written rationale, and false positives to suppress through the tool's ignore mechanism or your own wrapper script. That triage document, not the tool output, becomes your internal security baseline.
- Is laravel-security-check actively maintained and safe to depend on?
- The last release was published on 2025-05-26, which is a positive maintenance signal, but the project has roughly 60 stars and no known dependents, so there is little evidence of it running in real production estates. It is a single-maintainer package, so pin an exact version in composer.json, review the diff before bumping, and check issue and pull-request responsiveness plus any documented security disclosure path. Expect due diligence to take longer than the integration itself.
- What are the alternatives to laravel-security-check?
- Options include Enlightn, Laravel Security Checker, the built-in composer audit command, the Roave security-advisories feed for dependency CVEs, and secret scanning or SAST tools in your pipeline. If your requirements are narrow, writing 15 to 25 in-house assertions against config values is a realistic build-versus-buy comparison and removes the third-party dependency entirely. Compare candidates against what Dependabot, composer audit and your cloud CSPM already cover so you only add net-new checks.