Weave Code
Iniscan Laravel Package
psecio/iniscan
psecio/iniscan is a PHP security scanner that checks your php.ini configuration against recommended security settings. It highlights risky directives and helps harden production environments, making it useful for audits, CI checks, and server reviews.
A php.ini scanner for best security practices
Frequently asked questions about Iniscan
- Is psecio/iniscan a Laravel package or a php.ini scanner?
- psecio/iniscan is a PHP security scanner for php.ini configuration, not a Laravel runtime package. It checks directives such as error display, sessions, uploads, cookies, disabled functions, and open_basedir against recommended hardening practices. In Laravel projects it belongs alongside development and CI tooling rather than in application middleware or production runtime dependencies.
- How do I install psecio/iniscan in a Laravel project with Composer?
- Install it as a Composer dev dependency, typically with composer require --dev psecio/iniscan. Run the CLI entry point from vendor/bin and keep it out of production runtime requirements. Check the package Composer constraints against your PHP version before adding it to your project.
- Can I run psecio/iniscan in Laravel CI or as an Artisan command?
- Yes, it fits well as a CI quality gate or a custom Artisan wrapper command. Run it against the php.ini used by your target environment, capture the output, and fail the job on high-severity findings. Keep the wrapper as a development or operations command, not as application middleware.
- Does psecio/iniscan scan the effective php.ini used by PHP-FPM or only a specified file?
- Do not assume it reads the effective configuration for every SAPI. The scanner generally checks a php.ini file you point it at, so CLI, PHP-FPM, Apache module, and container configurations may differ. Export or mount the production-equivalent ini and scan that file, especially for Laravel deployments running under FPM.
- Which PHP versions and Laravel versions does psecio/iniscan support?
- The provided context does not guarantee current PHP or Laravel support, so verify Packagist and Composer constraints before adoption. Test the scanner on the same PHP minor version your Laravel application uses in production. Because Laravel releases map to specific PHP ranges, validate compatibility as part of your upgrade process.
- What report formats does psecio/iniscan provide for CI and audit evidence?
- It is primarily a CLI scanner, so CI evidence usually comes from captured console output and the process exit code. The context does not confirm a stable JSON, SARIF, or other machine-readable format, so check the pinned version's CLI options. If structured reporting is required, wrap the command and convert its output for your security dashboard.
- Can I baseline or waive psecio/iniscan findings for accepted risks?
- The core scanner may not provide first-class baselining, so plan for an exception process around it. Classify findings as must-fix, accepted risk, or environment-specific, and store waivers with an owner and review date. A custom Artisan or CI wrapper can apply these policies and fail only on unapproved high-severity findings.
- Does psecio/iniscan work for Docker, Kubernetes, and managed hosting deployments?
- It can work well if you scan the php.ini that is actually baked into your image or loaded by production workers. For Docker and Kubernetes, run the scan during image build or in CI rather than only against live hosts. On managed hosting where php.ini is controlled externally, export the effective configuration or rely on provider-native controls alongside the scan.
- How does psecio/iniscan compare to Composer audit, PHPStan, or Laravel security scanners?
- It complements those tools by validating the runtime PHP configuration layer rather than application code or dependency vulnerabilities. Composer audit checks packages, PHPStan checks code quality, and Laravel security checks cover application concerns, while iniscan focuses on php.ini directives. Use it alongside them as part of a broader engineering quality gate.
- Is psecio/iniscan actively maintained and safe to depend on long term?
- The repository and maintenance status are unclear from the provided context, so treat long-term package health as a risk. Pin versions, monitor upstream activity, and be prepared to fork or replace it with an internal rule set if it becomes stale. Assign ownership to platform or security engineering and review the tool after PHP or runtime upgrades.
Weaver
How can I help you explore Laravel packages today?