PHPackages corevitals/auditron - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Security](/categories/security) 4. / 5. corevitals/auditron ActiveLibrary[Security](/categories/security) corevitals/auditron =================== A standalone Symfony console application for executing security checks. v1.0.3(1mo ago)02MITPHPPHP >=8.2 Since Jun 28Pushed 1mo agoCompare [ Source](https://github.com/Corevitals/auditron)[ Packagist](https://packagist.org/packages/corevitals/auditron)[ RSS](/packages/corevitals-auditron/feed)WikiDiscussions main Synced 2w ago READMEChangelogDependencies (5)Versions (5)Used By (0) Auditron ======== [](#auditron) > **Tomorrow's Security... Today.** Auditron is a security inspection unit for Symfony applications. It scans your project for common security issues, insecure configurations, and development mistakes before they become production incidents. Designed specifically for the Symfony ecosystem, Auditron provides fast, actionable security checks without requiring a running application. Features -------- [](#features) Current inspections include: CheckDescription**Autoload Files**Detects Composer autoloaded files that execute automatically and may introduce unnecessary risk.**Composer Security**Reviews Composer configuration for insecure settings and unsafe practices.**CSRF Configuration**Ensures CSRF protection is enabled where appropriate.**Environment Variable Security**Detects insecure handling of environment variables and sensitive configuration.**Exception Leak Detection**Identifies configurations that may expose stack traces or internal application details.**File Permissions**Checks for insecure permissions on application files and directories.**Forbidden Functions**Detects usage of dangerous PHP functions such as `eval()`, `exec()`, `shell_exec()`, and similar APIs.**.gitignore Security**Verifies that sensitive files are excluded from version control.**Hardcoded Secrets**Searches for API keys, passwords, tokens, private keys, and other embedded secrets.**Insecure Deserialization**Detects potentially dangerous unserialization patterns.**Sensitive Information Exposure**Finds files and configuration that may unintentionally expose sensitive data.**Session Cookie Security**Verifies secure cookie flags such as `Secure`, `HttpOnly`, and `SameSite`.**Weak Password Hashers**Detects insecure password hashing algorithms and outdated hasher configuration.Additional security checks will be added over time. --- Installation ------------ [](#installation) Install via Composer: ``` composer require --dev corevitals/auditron ``` --- Usage ----- [](#usage) Run Auditron from the root of your Symfony project: ``` php bin/auditron ``` Example: ``` $ php bin/auditron AUDITRON™ Security Inspection Unit v1.0 Scanning Symfony application... ✔ Composer Security ✔ CSRF Configuration ✔ Session Cookie Flags ⚠ Hardcoded Secrets ✔ Weak Password Hashers ✔ File Permissions Scan completed. 13 checks performed 1 warning 0 critical issues ``` --- Philosophy ---------- [](#philosophy) Auditron focuses on practical security issues that are easy to overlook during development. Rather than acting as a full-fledged static analyzer, it concentrates on Symfony-specific security best practices, secure configuration, and common application vulnerabilities. The goal is simple: > Find security problems before attackers do. --- Roadmap ------- [](#roadmap) Future inspections may include: - Security headers - Trusted proxies validation - CORS configuration - Doctrine entity security - File upload validation - Security voter analysis - Firewall configuration auditing - Access control verification - Dependency vulnerability integration - Secret manager detection - Docker and container security - CI/CD security validation --- Contributing ------------ [](#contributing) Contributions are welcome. Ideas for additional security checks, bug reports, and pull requests are encouraged. Each security check is implemented as an independent class, making it easy to extend Auditron with new inspections. --- License ------- [](#license) MIT License. ### Health Score 39 — LowBetter than 84% of packages Maintenance91 Actively maintained with recent releases Popularity3 Limited adoption so far Community6 Small or concentrated contributor base Maturity49 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~2 days Total 3 Last Release 41d ago ### Community Maintainers ![](https://avatars.githubusercontent.com/u/195736879?v=4)[icebrkr](/maintainers/icebrkr)[@icebrkr](https://github.com/icebrkr) --- Top Contributors [![tlorens](https://avatars.githubusercontent.com/u/135409?v=4)](https://github.com/tlorens "tlorens (10 commits)") ### Code Quality TestsPHPUnit ### Embed Badge ![Health badge](/badges/corevitals-auditron/health.svg) ``` [![Health](https://phpackages.com/badges/corevitals-auditron/health.svg)](https://phpackages.com/packages/corevitals-auditron) ``` ### Alternatives [drupal/core Drupal is an open source content management platform powering millions of websites and applications. 19467.3M1.9k](/packages/drupal-core)[drupal/core-recommended Locked core dependencies; require this project INSTEAD OF drupal/core. 6943.5M448](/packages/drupal-core-recommended)[matomo/matomo Matomo is the leading Free/Libre open analytics platform 21.7k39.6k](/packages/matomo-matomo)[shopware/core Shopware platform is the core for all Shopware ecommerce products. 595.8M667](/packages/shopware-core)[jolicode/castor A lightweight and modern task runner. Automate everything. In PHP. 55344.7k5](/packages/jolicode-castor)[friendsoftypo3/content-blocks TYPO3 CMS Content Blocks - Content Types API | Define reusable components via YAML 103574.3k68](/packages/friendsoftypo3-content-blocks) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)