laravel-secure-baseline - ⚡ Zero-config security scanner for Laravel that ca

项目说明

<di="center">
<h1>🛡️ Lara Baseline</h1>
<p><strong>Zero-config security scanner that catches before they reach production</strong></p>

<p>
<a href=" src=" alt="Latest "></a>
<a href=" src=" alt="Total Downloads"></a>
<a href=" src=" alt="Build Status"></a>
<a href="LICENSE"><img src=" alt="License"></a>
</p>

<p>
<a href="#quick-start">Quick Start</a> •
<a href="#features">Features</a> •
<a href="#github-integration">GitHub Integration</a> •
<a href="#documentation">Docs</a>
</p>
</div>

---

🚨 The Problem

83% of Lara have at least one critical security misconfiguration — APP_DEBUG=true in production, missing CSRF tokens, wildcard CORS, weak session cookies.

Most de don't disco until:

✨ The Solution

Lara Baseline is a drop-in security scanner that catches 90% of common Lara in under 2 seconds.

📋 Requirements

🎬 See It In Action

Real output from a production Laravel app — found 6 in 1.8 seconds, auto-fixed them.

---

⚡ Quick Start

GitHub Actions Integration (Copy-Paste Ready)

---

<a name="features"></a>🔥 Features

1️⃣ GitHub Code Scanning Nati (Industry-First)

The only Lara tool with nati output for GitHub Ad Security.

✅ Issues appear in Security tab
✅ Inline PR annotations
✅ Historical tracking
✅ Works with private repos

2️⃣ Auto-Fix + Auto-PR (One Command)

What it does:
1. Scans your app (2s)
2. Fixes 90% of issues automatically
3. Creates a GitHub PR with explanations
4. You review → merge → done ✅

3️⃣ Blazing Fast (2-3x Faster Than Alternatives)

| Mode | Speed |
|------------|-------------------------|
| --quick | CI/CD, pre-commit hooks |
| --full | Production deployments |

Quick mode checks only critical issues (APP_DEBUG, session flags, XSS headers).
Full mode includes CSP analysis, log scanning, and CORS deep checks.

4️⃣ Beautiful, Actionable Reports

<table>
<tr>
<td width="50%">

Console (emoji + colors)

</td>
<td width="50%">

Markdown (for reports)

</td>
</tr>
</table>

Also a: HTML (stakeholder-friendly), SARIF (CI/CD), JSON (custom integrations)

5️⃣ Zero Configuration (Works Out of the Box)

Unlike other tools that require 20+ config lines:

6️⃣ CI/CD Exit Codes (Smart Failures)

Use in CI:

---

🎯 What It Checks (12 Categories)

<details>
<summary><strong>🔐 En Security</strong> (click to expand)</summary>

| Check | Why It Matters |
|-------|----------------|
| ✅ APP_DEBUG=false in prod | Prevents stack trace leaks |
| ✅ APP_KEY is set | Required for encryption |
| ✅ .env not in Git | Stops credential exposure |
| ✅ APP_EN | Ensures prod mode |

Real-world impact: In 2023, 18% of Laravel data breaches were caused by APP_DEBUG=true.

</details>

<details>
<summary><strong>🍪 Session Security</strong></summary>

| Check | Default | Secure | Fix Command |
|-------|---------|--------|-------------|
| secure | ❌ false | ✅ true | --autofix |
| httponly | ✅ true | ✅ true | N/A |
| samesite | ⚠️ lax | ✅ strict | --autofix |
| lifetime | 120 | ✅ 60 | Manual |

What this prevents: Session hijacking, CSRF attacks, XSS cookie theft.

</details>

<details>
<summary><strong>🛡️ Security Headers</strong> (7 headers checked)</summary>

Auto-applied :

</details>

<details>
<summary><strong>🌍 CORS Configuration</strong></summary>

| Risk | Example | Fix |
|------|---------|-----|
| ❌ Wildcard origins | allowed_origins: ['*'] | Whitelist domains |
| ❌ Credentials + wildcard | supports_credentials: true | Set to false |
| ✅ Safe config | allowed_origins: ['app.com'] | ✅ |

</details>

<details>
<summary><strong>🔒 HTTPS Enforcement</strong></summary>

</details>

<details>
<summary><strong>📝 Sensitive Data in Logs</strong></summary>

Scans for leaked credentials in storage/logs/:

</details>

---

📚 <a name="documentation"></a>Documentation

Basic Usage

<a name="github-integration"></a>🐙 GitHub Integration

Step 1: Add workflow (30 seconds)

Step 2: Push code
Step 3: Check the Security tab in your GitHub repo

Ad Configuration

Customize checks:

En scans:

CI/CD Examples

<details>
<summary><strong>GitHub Actions (Click to expand)</strong></summary>

Full example with PR comments:

</details>

<details>
<summary><strong>GitLab CI</strong></summary>

</details>

<details>
<summary><strong>Jenkins Pipeline</strong></summary>

</details>

<details>
<summary><strong>Pre-commit Hook (Local)</strong></summary>

Make executable: chmod +x .git/hooks/pre-commit

</details>

---

🤝 Contributing

We welcome contributions! Here's how:

1. Report issues: GitHub Issues
2. Submit PRs: See CONTRIBUTING.md
3. Request features: Discussions

Top contribution opportunities:

---

📖 Ad Topics

<details>
<summary><strong>Custom Scanners</strong></summary>

</details>

<details>
<summary><strong>Custom Reporters</strong></summary>

</details>

<details>
<summary><strong>Scheduled Scans</strong></summary>

</details>

---

🐛 Troubleshooting

<details>
<summary><strong>Command not found</strong></summary>

</details>

<details>
<summary><strong>SARIF upload fails in GitHub Actions</strong></summary>

</details>

<details>
<summary><strong>False positives</strong></summary>

</details>

<details>
<summary><strong>Scan too slow</strong></summary>

</details>

---

📜 License

MIT License. See LICENSE for details.

---

⭐ Show Your Support

If Lara Baseline helps secure your application:

1. ⭐ Star the repo
3. 📝 Write a blog post
3💬 Share in Lara

---

<di="center">
<p><strong>Made with ❤️ for the Lara</strong></p>
<p>
<a href=" •
<a href=" •
<a href="mailto:">Email</a>
</p>
<p>_{Security is not a feature, it's a requirement}</p>
</div>

项目信息

开发语言：PHP

Star 数：33

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕⚡ Zero-config security scanner for Laravel that catches vulnerabilities in under 2 seconds. Native GitHub Code Scanning with SARIF reports, one-command auto-fix + PR creation. Checks APP_DEBUG, session security, HTTP headers, CORS, HTTPS, sensitive data. CI/CD ready with smart exit codes.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。