Clamav Laravel Package

Product Decisions This Supports

• Feature: user-generated content ingestion — whether to add malware/virus scanning to uploads, imports, email attachments, or API payloads. The package provides Laravel-native ergonomics (config, facade, validation rule), so "scan before persist" becomes a small, reversible build rather than a security project.
• Roadmap: security/compliance hardening — supports SOC 2, ISO 27001, and enterprise security questionnaires that ask "do you scan uploaded files?" with a credible, auditable answer that doesn't require owning a bespoke ClamAV integration.
• Build vs buy — the real decision is "integrate ClamAV directly vs use this wrapper." This package wins when you want Laravel conventions (config publishing, facades, validation rules, queue-friendliness) and give up little in return.
• v2.1.0 Scanner::scanStream() — meaningfully changes the calculus for streamed/in-memory content: scanning S3 objects, HTTP request bodies, base64-decoded or generated payloads before they touch disk. Previously you'd write a temp file to scan; now you can scan the stream directly. This unlocks:
  • Serverless / ephemeral compute (Lambda, Fargate, containerized workers) where local temp files are awkward, slow, or costly.
  • Pre-persist rejection — validate content before writing potentially malicious bytes to storage at all.
  • Chunked/large uploads and pass-through proxies where a full local copy is undesirable.
• Architecture decisions — where ClamAV runs (sidecar/daemon/socket), how it's wired into queues/Horizon, and whether scanning is synchronous on the request path. scanStream() lowers the cost of synchronous pre-persist scanning, so "scan inline before commit" becomes a viable option rather than a temp-file workaround.

When to Consider This Package

Adopt when:

• You're on Laravel/PHP and need file or stream malware scanning with minimal glue code.
• You have (or will operate) a reachable ClamAV daemon/socket — e.g., a clamav/clamav container, sidecar, or host service.
• You want framework-idiomatic ergonomics: config, facade, validation rule, testability.
• Your need is "is this content malicious?" rather than sandbox detonation, multi-engine verdicts, or DLP.
• You need streaming scans (post-v2.1.0) for object storage, request bodies, or ephemeral filesystems.

Look elsewhere or reconsider when:

• You want a managed scanning API (VirusTotal, cloud-native malware detection) instead of self-hosted ClamAV.
• You can't own the ClamAV runtime — signature updates, memory footprint, daemon health — and don't want that ops burden.
• You need CDR (content disarm & reconstruction), sandbox detonation, or broader DLP beyond AV signatures.
• Your stack isn't Laravel/PHP; the value here is largely framework integration.
• You require vendor SLAs or guaranteed support; standard OSS maintenance risk applies.

How to Pitch It (Stakeholders)

For executives: We can add malware scanning to file uploads with a small, well-scoped integration instead of a bespoke security build. It wraps ClamAV — open source and widely deployed — behind a Laravel package, so incremental cost is mostly operational (running the scanner) rather than engineering. The v2.1.0 streaming API lets us scan content before it's written to disk and fits our serverless/object-storage direction, reducing both risk and infra overhead. Recommendation: low-risk adoption with a contained blast radius; the main trade-off is owning the ClamAV runtime.

For engineering: Drop-in Laravel package — config, facade, validation rule, queue-friendly. v2.1.0 adds Scanner::scanStream() for in-memory/streamed content (S3, request bodies, chunked uploads) without temp-file juggling. Requires a reachable ClamAV daemon/socket plus a plan for signature updates and health checks. Testable via mocks/fakes. Keep scanning off the hot path where possible (queue after persist) or use scanStream() to reject content before it's persisted.