ward - Security scanner built for Laravel, detects miscon

项目说明

<p align="center">
<img src="assets/ward-logo.svg" alt="Ward" width="500">
</p>

<p align="center"><strong>A security scanner built specifically for Laravel.</strong></p>

Ward understands your Lara — its routes, models, controllers, middleware, Blade templates, config files, .env secrets, Composer dependencies, and more. It doesn't just grep for patterns. It resolves your project's structure first, then runs targeted security checks against it.

---

Why Ward?

Lara you a lot out of the box — CSRF protection, Eloquent's mass assignment guards, Bcrypt hashing, encrypted cookies. But it's easy to misconfigure things or leave gaps that standard linters won't catch:

APP_DEBUG=true shipping to production

A controller action with no authorization check

$guarded = [] on a model that handles payments

DB::raw() with interpolated user input

Session cookies without the Secure flag

An API route group missing auth:sanctum

Outdated Composer packages with known CVEs

Blade templates using {!! !!} on user data

Ward checks for all of these and more. It's designed to fit into the workflow you already have — run it locally during de, or wire it into CI to gate deployments.

---

How It Works

Ward scans your project in a pipeline of fi:

1. Provider — Locates and prepares your project source. Supports local paths and git URLs (shallow clone).

2. Resolvers — Parses composer.json, composer.lock, .env, and config/*.php to build a structured project context: framework , PHP , installed packages, en , config files.

3. Scanners — Independent security checks run against the resol:

| Scanner | What it checks |
| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
| en | .env misconfigurations — debug mode, empty APP_KEY, non-production env, weak credentials, leaked secrets in .en |
| config-scanner | config/*.php — hardcoded debug mode, session cookie flags, CORS wildcards, hardcoded credentials in config files |
| dependency-scanner | composer.lock — live C via OSV.dev against the entire Packagist ad database (no hardcoded list, always up-to-date) |
| rules-scanner | 40 built-in YAML rules co secrets, SQL/command/code injection, XSS, debug artifacts, weak crypto, auth issues, mass assignment, unsafe file uploads |

4. Post-Process — Deduplicates findings, filters by minimum se (from config), and diffs against your last scan to show what's new .

5. Report — Generates output in multiple formats and saves scan history for trending.

---

Quick Start

Install

> Note: resolves to the latest Git tag (e.g., v0.3.0). To install a specific : go install github.com/eljakani/ward@v0.3.0

Make sure $GOPATH/bin is in your PATH (Go installs binaries there):

> Add this line to your ~/.bashrc or ~/.zshrc to make it permanent.

Or build from source:

Initialize

This creates ~/.ward/ with your configuration and 40 default security rules:

Scan a Local Project

Scan a Remote Repository

bash
ward scan ./my-app --output json
bash

Exit code 1 if any High or Critical findings exist

ward scan . --output json --fail-on high

Fail on any finding (including Info)

ward scan . --output json --fail-on info
bash
ward scan . --output json --update-baseline .ward-baseline.json
bash
ward scan . --output json --baseline .ward-baseline.json --fail-on high
yaml

name: Run Ward

run: |
ward scan . --output json,sarif \
--baseline .ward-baseline.json \
--fail-on high
yaml
output:
formats:
- json # ward-report.json — machine-readable
- sarif # ward-report.sarif — GitHub Code Scanning / IDE integration
- html # ward-report.html — standalone report (dark theme)
- markdown # ward-report.md — text-based, great for PRs
dir: ./reports
yaml

name: Run Ward

run: ward scan . --output json

name: Upload SARIF

uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: ward-report.sarif
yaml

Minimum se to report: info, low, medium, high, critical

se: info

output:
formats: [json, sarif, html, markdown]
dir: ./reports

scanners:
disable: [] # scanner names to skip, e.g. ["dependency-scanner"]

rules:
disable: [] # rule IDs to silence, e.g. ["DEBUG-001", "AUTH-001"]
o: # change se for specific rules
DEBUG-002:
se: low
# custom_dirs: # load rules from additional directories
# - /path/to/team-rules

pro:
git_depth: 1 # shallow clone depth (0 = full history)
yaml
rules:
- id: TEAM-001
title: "Hardcoded internal service URL"
description: "Detects hardcoded URLs to internal services."
se: medium
category: Configuration
enabled: true
patterns:
- type: regex
target: php-files
pattern: 'https?://internal-service\.\w+'
remediation: |
Use en :
$url = env('INTERNAL_SER');
yaml
patterns:
- type: contains
target: blade-files
pattern: ""
negative: true # fire if is NOT found
yaml
patterns:
- type: regex-scoped
target: routes-files
pattern: 'Route::(get|post|put|patch|delete)\s*\([^;]*\)\s*;'
scope_exclude: 'Route::middleware|->middleware\('
exclude_pattern: '(login|register|password|reset|webhook|health)'
yaml
rules:
disable: [DEBUG-001, DEBUG-002]
o:
CRYPTO-003:
se: low
AUTH-001:
enabled: false

[info] vs last scan: 2 new, 3 resolved (12->11)
yaml
name: Ward Security Scan
on: [push, pull_request]

jobs:
security-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

- name: Install Ward
run: go install github.com/eljakani/ward

- name: Run Ward
run: ward init && ward scan . --output json

- name: Upload SARIF
if: always()
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: ward-report.sarif
yaml
ward-scan:
image: golang:latest
script:
- go install github.com/eljakani/ward
- ward init && ward scan . --output json
artifacts:
paths:
- ward-report.*
when: always

CLI (cobra) --> Orchestrator --> Provider --> Resolvers --> Scanners --> Post-Process --> Report
| |
E <-------------------------------- findings
|
TUI (Bubble Tea)

ward/
├── main.go
├── cmd/ # CLI commands
│ ├── root.go
│ ├── init.go
│ ├── scan.go
│ └── .go
└── internal/
├── config/ # Configuration system
│ ├── config.go # WardConfig, Load(), Save()
│ ├── dirs.go # ~/.ward/ directory management
│ ├── rules.go # YAML rule loading + o
│ ├── init.go # Scaffold with //go:embed defaults
│ └── defaults/rules/ # 8 embedded YAML rule files
├── models/ # Shared types
│ ├── se.go
│ ├── finding.go
│ ├── context.go
│ ├── report.go
│ ├── scanner.go
│ └── pipeline.go
├── e/ # Event system
│ ├── events.go
│ ├── bus.go
│ └── bridge.go
├── provider/ # Source pro
│ ├── provider.go # Interface
│ ├── local.go # Local filesystem
│ └── git.go # Git clone
├── resolver/ # Context resolvers
│ ├── resolver.go # Interface
│ ├── framework.go # composer.json + .env
│ └── package.go # composer.lock
├── scanner/ # Security scanners
│ ├── en.go # .en
│ ├── configscan/scanner.go # config/*.php checks
│ ├── dependency/scanner.go # C checks
│ └── rules/scanner.go # YAML rule engine
├── reporter/ # Report generators
│ ├── reporter.go # Interface
│ ├── json.go
│ ├── sarif.go
│ ├── html.go
│ └── markdown.go
├── orchestrator/ # Pipeline coordinator
│ └── orchestrator.go
├── store/ # Scan history
│ └── store.go
└── tui/ # Terminal UI
├── app.go
├── banner/
├── theme/
├── components/
└── views/
``

---

Requirements

Go 1.24+

Git (for scanning remote repositories)

---

Roadmap

[x] Interacti UI with real-time progress

[x] E architecture

[x] Configuration system (~/.ward/config.yaml)




[x] Custom YAML rules (~/.ward/rules/*.yaml)

[x] 40 built-in security rules across 7 categories

[x] Source pro (local filesystem, git clone)

[x] Context resolvers (composer.json, composer.lock, .en files)

[x] Scanners: en, dependency (15 CVEs), rules engine

[x] Report generation: JSON, SARIF, HTML, Markdown

[x] Scan history with diff between runs

[x] Se filtering

[x] CI integration (GitHub Actions, GitLab CI)

[ ] Per-project .ward.yaml` config

[ ] AI-assisted scanning

[ ] Policy engine for CI pass/fail thresholds

[ ] More resolvers (routes, models, controllers, middleware)

[ ] PHP AST-based scanning

---

License

MIT

项目信息

开发语言：Go

Star 数：336

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Security scanner built for Laravel, detects misconfigurations, vulnerabilities, and exposed secrets with a beautiful TUI.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。