PHPackages abdalmolood/laravel-ai-security-guardian - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Security](/categories/security) 4. / 5. abdalmolood/laravel-ai-security-guardian ActiveLibrary[Security](/categories/security) abdalmolood/laravel-ai-security-guardian ======================================== A defensive AI-powered Laravel security guardian package. 00PHPCI failing Since Jun 5Pushed 1mo agoCompare [ Source](https://github.com/amolood/laravel-ai-security-guardian)[ Packagist](https://packagist.org/packages/abdalmolood/laravel-ai-security-guardian)[ RSS](/packages/abdalmolood-laravel-ai-security-guardian/feed)WikiDiscussions main Synced 1w ago READMEChangelogDependenciesVersions (1)Used By (0) Laravel AI Security Guardian ============================ [](#laravel-ai-security-guardian) [![Packagist Version](https://camo.githubusercontent.com/d5d294242dcb689513fc06aa1b225d8c7ab8527997a3aedac177022e5633cdf9/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f616264616c6d6f6c6f6f642f6c61726176656c2d61692d73656375726974792d677561726469616e2e737667)](https://packagist.org/packages/abdalmolood/laravel-ai-security-guardian)[![License](https://camo.githubusercontent.com/5a1c1d28500cb1bb85ce53963e953226e2b35fb81b33541a6f04a2d90fe80ef7/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c6963656e73652f616d6f6c6f6f642f6c61726176656c2d61692d73656375726974792d677561726469616e2e737667)](https://github.com/amolood/laravel-ai-security-guardian)[![PHP Version](https://camo.githubusercontent.com/eebfeb80482c8b896dff0a49d47a9960936961bba1a8aad1d948a028a7c7d413/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d253545382e322d3737374242342e737667)](https://www.php.net/)[![Laravel Support](https://camo.githubusercontent.com/ccdadf9b5dfa71184f260c4fdcddb859074cae14f64608136afa12746de590bb/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c61726176656c2d3130253230253743253230313125323025374325323031322d4646324432302e737667)](https://laravel.com/)[![Tests](https://camo.githubusercontent.com/f7798ff0e12f337a24121534264d711364f6795793f0fa86b76eda9ef888c580/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f74657374732d506573742d3045413545392e737667)](https://pestphp.com/) Laravel AI Security Guardian is a defensive security package for Laravel applications. It scans for dependency issues, insecure code patterns, misconfiguration, risky uploads, unsafe routes, and common business logic weaknesses. It also provides a review-first UI, safe report generation, and optional AI-assisted analysis with token-aware safeguards. Highlights ---------- [](#highlights) - Local security scanners for dependency, configuration, Blade, route, upload, and code risk checks. - Optional AI-assisted deep scan for higher-level triage and remediation guidance. - Review-first dashboard for scans, findings, reports, patch suggestions, provider settings, notifications, and health checks. - Safe auto-fix workflow with explicit review gates. - Multi-language UI support with RTL output. - JSON and Markdown report generation. - Designed to minimize unnecessary AI token usage. Requirements ------------ [](#requirements) - PHP 8.2 or newer - Laravel 10, 11, or 12 - A supported AI provider if deep analysis is enabled Installation ------------ [](#installation) Install the package with Composer: ``` composer require abdalmolood/laravel-ai-security-guardian ``` Publish the package configuration: ``` php artisan vendor:publish --tag=ai-security-guardian-config ``` Publish the migrations and run them: ``` php artisan vendor:publish --tag=ai-security-guardian-migrations php artisan migrate ``` Optional: publish the package views and translations if you want to customize them. ``` php artisan vendor:publish --tag=ai-security-guardian-views php artisan vendor:publish --tag=ai-security-guardian-lang ``` Quick Start ----------- [](#quick-start) Add the required environment variables: ``` AI_SECURITY_ENABLED=true AI_SECURITY_UI_ENABLED=true AI_SECURITY_UI_PREFIX=ai-security AI_SECURITY_UI_THEME=auto AI_SECURITY_UI_LOCALE=en AI_SECURITY_UI_AVAILABLE_LOCALES=en,ar AI_SECURITY_UI_RTL_LOCALES=ar AI_SECURITY_PROVIDER=openai AI_SECURITY_OPENAI_API_KEY=your_api_key AI_SECURITY_OPENAI_MODEL=gpt-4.1 AI_SECURITY_AI_ENABLED=true AI_SECURITY_DEEP_SCAN_ENABLED=true AI_SECURITY_AI_MAX_FINDINGS=12 AI_SECURITY_AI_MAX_TEXT_LENGTH=360 AI_SECURITY_AI_MAX_REFERENCES=3 AI_SECURITY_AI_MAX_COMPLETION_TOKENS=1200 ``` Run a standard scan: ``` php artisan ai-security:scan ``` Run an in-depth scan with AI assistance: ``` php artisan ai-security:scan --deep ``` The deep scan command also has an alias: ``` php artisan ai-security:scan:deep ``` Generate the latest report: ``` php artisan ai-security:report php artisan ai-security:report --format=json ``` Open the dashboard in your browser: ``` /ai-security ``` Features -------- [](#features) ### Security Scanners [](#security-scanners) The package includes scanners for: - Composer dependency vulnerabilities - Dangerous environment and config values - Unsafe Blade output - Route and middleware access gaps - Unsafe file upload flows - Sensitive PHP patterns and raw SQL usage - Optional AST-based heuristics for larger application patterns ### Review-First UI [](#review-first-ui) The dashboard is intentionally read-focused: - Scan history - Finding triage - Report generation - Patch suggestions - Provider settings - Scanner settings - Notification settings - Health checks - Help and usage guidance ### Token-Aware AI Usage [](#token-aware-ai-usage) The AI pipeline is designed to avoid waste: - Context is redacted before being sent to a provider - Findings are compacted and deduplicated - Request size is capped - Completion size is capped - Identical requests can be cached - Deep analysis runs only when it is explicitly enabled and needed AI Providers ------------ [](#ai-providers) The package supports: - OpenAI - Gemini - DeepSeek - Custom OpenAI-compatible endpoints Example provider configuration: OpenAI example: ``` AI_SECURITY_PROVIDER=openai AI_SECURITY_OPENAI_API_KEY=your_api_key AI_SECURITY_OPENAI_MODEL=gpt-4.1 ``` Custom provider example: ``` AI_SECURITY_PROVIDER=custom AI_SECURITY_CUSTOM_BASE_URL=http://localhost:11434/v1 AI_SECURITY_CUSTOM_API_KEY=local-key AI_SECURITY_CUSTOM_MODEL=your-model ``` Scheduler --------- [](#scheduler) Daily scans can be enabled through configuration. Laravel's scheduler must still be active in production: ``` * * * * * cd /path-to-your-project && php artisan schedule:run >> /dev/null 2>&1 ``` Default scan time: ``` AI_SECURITY_SCAN_TIME=03:00 ``` Localization and RTL -------------------- [](#localization-and-rtl) The package ships with English and Arabic translations. Locale and RTL behavior can be configured with: ``` AI_SECURITY_UI_LOCALE=en AI_SECURITY_UI_AVAILABLE_LOCALES=en,ar AI_SECURITY_UI_RTL_LOCALES=ar ``` You can switch languages from the UI, and pages will render with the correct direction automatically. RTL is based on the active locale. Notifications ------------- [](#notifications) Supported notification channels: - Email - Telegram - Slack Example configuration: ``` AI_SECURITY_MAIL_ENABLED=true AI_SECURITY_MAIL_TO=security@yourdomain.com AI_SECURITY_TELEGRAM_ENABLED=false AI_SECURITY_TELEGRAM_BOT_TOKEN= AI_SECURITY_TELEGRAM_CHAT_ID= AI_SECURITY_SLACK_ENABLED=false AI_SECURITY_SLACK_WEBHOOK_URL= ``` Safe Auto-Fix ------------- [](#safe-auto-fix) The package can produce safe fixes for eligible findings, but direct file modification remains gated. Enable direct fixes only when you have a clear review process: Edit the published config file: ``` // config/ai-security-guardian.php 'auto_fix' => [ 'enabled' => true, 'production_direct_fix' => false, ], ``` Set `production_direct_fix` to `true` only when you want to permit direct file changes for eligible findings. Run the fixer explicitly when you are ready: ``` php artisan ai-security:fix --direct ``` Rollback support is also available: ``` php artisan ai-security:rollback {patch_id} ``` Extending the Package --------------------- [](#extending-the-package) ### Add a Custom Scanner [](#add-a-custom-scanner) Implement `ScannerInterface` and register it in your application: ``` use Abdalmolood\AiSecurityGuardian\Contracts\ScannerInterface; use Illuminate\Support\Collection; class MyCustomScanner implements ScannerInterface { public function getName(): string { return 'My Custom Scanner'; } public function scan(): Collection { return collect(); } } ``` Register the scanner: ``` app(Abdalmolood\AiSecurityGuardian\Scanners\ScannerManager::class) ->registerScanner(new MyCustomScanner()); ``` ### Add a Custom AI Provider [](#add-a-custom-ai-provider) Implement `AiProviderInterface` to plug in another provider: ``` use Abdalmolood\AiSecurityGuardian\Contracts\AiProviderInterface; use Abdalmolood\AiSecurityGuardian\DTO\AiResponse; class MyCustomAiProvider implements AiProviderInterface { public function analyze(string $prompt, array $context = []): AiResponse { return new AiResponse([]); } } ``` Example Outputs --------------- [](#example-outputs) Example finding payload: ``` { "title": "APP_DEBUG is enabled in production", "severity": "critical", "category": "configuration", "affected_file": ".env", "description": "The APP_DEBUG environment variable is set to true in production.", "recommendation": "Set APP_DEBUG=false in the .env file." } ``` Example report summary: ``` # Security Scan Report ## Summary - Started At: 2024-01-01 10:00:00 - Total Findings: 1 - Risk Score: 10 ## Findings ### APP_DEBUG is enabled in production - Severity: Critical - Category: configuration - Affected File: .env ``` Testing ------- [](#testing) Run the test suite: ``` vendor/bin/pest ``` Support and Customization ------------------------- [](#support-and-customization) The package is built to be published and customized. You can override: - Config - Views - Translations - Migrations License ------- [](#license) MIT ### Health Score 19 — LowBetter than 9% of packages Maintenance59 Moderate activity, may be stable Popularity0 Limited adoption so far Community6 Small or concentrated contributor base Maturity11 Early-stage or recently created project Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Community Maintainers ![](https://avatars.githubusercontent.com/u/8304924?v=4)[ABDALRAHMAN MOLOOD](/maintainers/amolood)[@amolood](https://github.com/amolood) --- Top Contributors [![amolood](https://avatars.githubusercontent.com/u/8304924?v=4)](https://github.com/amolood "amolood (4 commits)") ### Embed Badge ![Health badge](/badges/abdalmolood-laravel-ai-security-guardian/health.svg) ``` [![Health](https://phpackages.com/badges/abdalmolood-laravel-ai-security-guardian/health.svg)](https://phpackages.com/packages/abdalmolood-laravel-ai-security-guardian) ``` ### Alternatives [mews/purifier Laravel 5/6/7/8/9/10 HtmlPurifier Package 2.0k18.7M144](/packages/mews-purifier)[paragonie/ecc PHP Elliptic Curve Cryptography library 24820.0k41](/packages/paragonie-ecc) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)