Iniscan Laravel Package

Product Decisions This Supports

• Build vs. buy for security configuration linting: psecio/iniscan is a mature, MIT-licensed, single-purpose CLI scanner. Adopting it lets us skip building a bespoke php.ini ruleset and instead invest engineering time in product features.
• Deployment hardening / secure defaults: Decides which php.ini directives (e.g., display_errors, expose_php, allow_url_include, session.cookie_secure) become non-negotiable across environments. The scan output becomes the canonical checklist.
• CI/CD gating policy: Whether to fail builds or emit warnings on configuration drift. Supports the roadmap item "hardening as code" and shifts security left without a full SAST investment.
• Compliance and audit evidence: Produces a repeatable, timestamped report that satisfies SOC 2 / PCI-DSS / ISO 27001 controls around server hardening—useful for security questionnaires in enterprise deals.
• Environment parity decisions: Compares dev, staging, and production configs, exposing risky divergence (e.g., debug settings leaking into prod).
• Incident response and drift detection: Baseline a known-good config; use scans to detect unauthorized changes after an incident or during periodic reviews.
• Prioritization signal: A fast, cheap audit that surfaces the highest-risk misconfigurations first, informing which infra backlog items to tackle next.

When to Consider This Package

Adopt when:

• The product runs on PHP stacks where php.ini is hand-managed, on shared hosting, or across heterogeneous fleets.
• You need a lightweight, license-clean tool that can be embedded in CI in under an hour.
• You operate in a regulated or enterprise context requiring demonstrable server hardening.
• Your team lacks deep PHP internals expertise and wants prescriptive, out-of-the-box guidance.
• You want a low-cost complement to—not a replacement for—existing security tooling.

Look elsewhere when:

• You need runtime application vulnerability scanning (SAST/DAST/SBOM); this only covers configuration.
• Configuration is fully managed by immutable infrastructure or policy engines (OPA, container scanners); overlap may make it redundant.
• You require active maintenance and vendor support—this is a single-maintainer, effectively feature-complete tool; plan to pin a version or fork.
• You only need one or two checks; a shell script may suffice.
• The application framework already enforces secure defaults and you lack authority over the underlying runtime.

How to Pitch It (Stakeholders)

For executives: A free, MIT-licensed scanner that gives us a credible, repeatable security story around PHP configuration at effectively zero cost. It reduces the risk of misconfiguration-driven breaches, produces audit-ready reports for enterprise buyers, and requires no procurement or vendor lock-in. Low investment, immediate risk reduction, and a tangible compliance artifact.

For engineering and security: One command audits php.ini against community-vetted best practices, with clear pass/fail/warn output and remediation guidance. It drops into CI to catch drift and block insecure deploys, and it's small enough to fork and extend if we need custom rules. Treat it as a hardening baseline—not a substitute for SAST/DAST—and pin the version to insulate us from maintenance risk.