Laravel Security Checker

This package provides an easy way for you to check your local composer.lock against the Symfony Security Advisories Checker. It can either display the results in your console of email them to you on a scheduled basis. It uses Laravel's markdown system so it should fit nicely in your own styling.

Screenshot

Installation

Require this package with composer using the following command:

composer require jorijn/laravel-security-checker

After updating composer, add the service provider to the providers array in config/app.php

Jorijn\LaravelSecurityChecker\ServiceProvider::class,

Note: On Laravel 5.5 and up, this package will use auto discovery and the above step is no longer required.

Configuration

If you want to have the package email the reports to you, you need to tell the package to who it should send it to.

Option 1

Add it to your .env file.

LCS_MAIL_TO="[email protected]"

Option 2

Publish the configuration file and change it there.

php artisan vendor:publish --provider="Jorijn\LaravelSecurityChecker\ServiceProvider" --tag="config"

If you want control on how the email is formatted you can have Laravel export the view for you using:

php artisan vendor:publish --provider="Jorijn\LaravelSecurityChecker\ServiceProvider" --tag="views"

By default, the package won't email you when there are no vulnerabilities found. You can change this setting by adding the following entry to your .env file.

LCS_EMAIL_WITHOUT_VULNERABILITIES=true

Scheduling

The packages exposes a new command for you:

php artisan security-check:email

You can hook it up into a regular crontab or add it into the Laravel Scheduler (app/Console/Kernel.php) like this:

protected function schedule(Schedule $schedule)
{
    $schedule->command(\Jorijn\LaravelSecurityChecker\Console\SecurityMailCommand::class)
        ->weekly();
}

Running as a command

This package provides a wrapper around the SensioLab's Security Checker command. You can call it using php artisan security-check:now.

Translations

If you need to translate this package into your own language you can do so by publishing the translation files:

php artisan vendor:publish --provider="Jorijn\LaravelSecurityChecker\ServiceProvider" --tag="translations"

Please consider helping out by creating a pull request with your own language to help out others.