PHPackages fahimtayebee/preflight - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. fahimtayebee/preflight ActiveLibrary[Authentication & Authorization](/categories/authentication) fahimtayebee/preflight ====================== A Laravel project audit and security checker package. v0.7.0(2mo ago)06MITPHPPHP ^8.2CI failing Since May 8Pushed 2mo agoCompare [ Source](https://github.com/ftayebee/preflight)[ Packagist](https://packagist.org/packages/fahimtayebee/preflight)[ RSS](/packages/fahimtayebee-preflight/feed)WikiDiscussions main Synced 3w ago READMEChangelog (7)Dependencies (4)Versions (8)Used By (0) Preflight ========= [](#preflight) A Laravel project audit and security checker for catching common risks before deployment. > Public Preview: Preflight is currently in public preview. It uses static/project scanning and may produce false positives. [![Tests](https://github.com/fahimtayebee/preflight/actions/workflows/tests.yml/badge.svg)](https://github.com/fahimtayebee/preflight/actions/workflows/tests.yml)[![Latest Version](https://camo.githubusercontent.com/6fa1ff972b269fa934222573474581c7e92e95562f298161d50b99eae6b94d95/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f666168696d746179656265652f707265666c696768742e737667)](https://packagist.org/packages/fahimtayebee/preflight)[![License](https://camo.githubusercontent.com/eef1768578d1f266f63f3fcb15f6468b6e6172825fcac5092f7c29fddb07c2a8/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f6c2f666168696d746179656265652f707265666c696768742e737667)](LICENSE)[![PHP Version](https://camo.githubusercontent.com/b685cedeeb84ce35de9fe2e749e4033ae8e7646a15a150820081cb662c854b1b/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f7068702d762f666168696d746179656265652f707265666c696768742e737667)](composer.json)[![Laravel](https://camo.githubusercontent.com/cda3a3caf1337c6e594a2b1be6a3166edf268a87d7254f5c4c82f1483814c1d7/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c61726176656c2d313125323025374325323031322d7265642e737667)](composer.json) Why Preflight Exists -------------------- [](#why-preflight-exists) Laravel projects often repeat risky mistakes before production deployment: unprotected routes, weak environment settings, unsafe controller patterns, sensitive migration fields, risky Composer packages, and missing request authorization. Preflight scans an existing Laravel application and reports findings in the terminal, JSON, Markdown, or SARIF. It is scanner/report only: no dashboard UI, no database tables, and no host application modifications. Installation ------------ [](#installation) ``` composer require fahimtayebee/preflight --dev ``` Publish the config: ``` php artisan vendor:publish --tag=preflight-config ``` Quick Start ----------- [](#quick-start) ``` php artisan preflight:audit ``` Example Commands ---------------- [](#example-commands) ``` php artisan preflight:audit php artisan preflight:audit --format=json php artisan preflight:audit --format=md --output=storage/app/preflight-report.md php artisan preflight:audit --format=sarif --output=storage/app/preflight.sarif php artisan preflight:audit --baseline php artisan preflight:audit --use-baseline php artisan preflight:audit --fail-under=80 php artisan preflight:audit --fail-on-severity=critical php artisan preflight:audit --explain php artisan preflight:audit --preset=relaxed php artisan preflight:audit --preset=strict --fail-on-severity=high ``` Commands -------- [](#commands) CommandPurpose`php artisan preflight:audit`Run the audit and generate a report.`php artisan preflight:baseline`Show, generate, prune, or clear the baseline.`php artisan preflight:report`Open or generate a local HTML report.`php artisan preflight:rules`List known rules and configured severities.`php artisan preflight:config-check`Validate Preflight configuration.`php artisan preflight:doctor`Check whether Preflight is ready in the host project.`php artisan preflight:self-test`Run Preflight internal health checks.See [docs/commands.md](docs/commands.md) for all command options. Report Formats -------------- [](#report-formats) Preflight supports: - `console` - `json` - `md` - `sarif` - `html` SARIF output can be uploaded to GitHub Code Scanning: ``` php artisan preflight:audit --format=sarif --output=storage/app/preflight.sarif ``` HTML Reports ------------ [](#html-reports) HTML reports are static, shareable audit reports for local review, clients, and CI artifacts. They are standalone files with inline CSS and no external assets. ``` php artisan preflight:audit --format=html --output=storage/app/preflight-report.html php artisan preflight:audit --format=html --output=storage/app/preflight-report.html --explain ``` If `--format=html` is used without `--output`, Preflight saves to the configured default path: `storage/app/preflight-report.html`. Local Report Viewer ------------------- [](#local-report-viewer) Open static HTML reports locally: ``` php artisan preflight:report php artisan preflight:report --generate php artisan preflight:report --generate --explain php artisan preflight:report --latest php artisan preflight:report --file=storage/app/preflight-report.html ``` The report viewer opens local HTML files. It does not create a persistent dashboard, require authentication, or use a database. Optional Report UI ------------------ [](#optional-report-ui) Preflight can also register a small read-only Laravel route UI for viewing generated HTML reports in a browser. It is disabled by default and recommended for local or protected development environments only. ``` 'ui' => [ 'enabled' => true, 'path' => 'preflight', 'middleware' => ['web', 'auth'], 'allowed_environments' => ['local', 'testing'], ], ``` When enabled, visit `/preflight` to list reports or `/preflight/latest` to view the newest report. The UI does not run audits from the browser, does not use a database, and does not store history. Reports may include file paths, route names, and security findings, so do not expose it publicly without authentication and environment restrictions. See [docs/ui.md](docs/ui.md) for setup and security guidance. Explainability And Presets -------------------------- [](#explainability-and-presets) Use `--explain` when reviewing findings locally: ``` php artisan preflight:audit --explain ``` Expanded output includes why the finding matters, how to fix it, bad and better examples when available, false-positive guidance, and a rule docs URL. Use presets to adjust runtime reporting without changing config: ``` php artisan preflight:audit --preset=relaxed php artisan preflight:audit --preset=strict --fail-on-severity=high ``` - `relaxed` hides low-confidence findings for first adoption runs. - `default` preserves normal behavior. - `strict` includes all enabled rules and low-confidence findings for mature CI. Reports include `confidence_counts` so teams can see how many findings are high, medium, or low confidence. Changed Files Mode ------------------ [](#changed-files-mode) Changed files mode is useful for pull requests. It uses Git diff output to scan changed files with file-based scanners, while still allowing project-wide checks such as env, routes, and auth. ``` php artisan preflight:audit --changed --base-ref=origin/main ``` The default base ref and fallback behavior are configurable. See [Changed files mode](docs/changed-files.md). False-Positive Guidance ----------------------- [](#false-positive-guidance) Preflight reports include confidence levels and, with `--explain`, rule-specific guidance for handling false positives. Prefer tuning scanner options or using a reviewed baseline before disabling broad rule groups. Examples: ``` php artisan preflight:audit --explain php artisan preflight:audit --preset=relaxed ``` See [False positives](docs/false-positives.md) and [Explainability](docs/explainability.md). Tested Against -------------- [](#tested-against) Preflight is tested using fixture projects and real Laravel project structures, including: - Fresh Laravel-style project structure - Laravel API-style project structure - Laravel admin-panel style project structure - Risky project fixtures with known findings - Clean project fixtures with expected passing results These tests improve rule reliability, but they do not claim complete security coverage. Scanners -------- [](#scanners) - `EnvScanner` - `RouteScanner` - `ControllerScanner` - `ModelScanner` - `MigrationScanner` - `RequestScanner` - `ComposerScanner` - `PolicyScanner` - `BladeScanner` - `AuthScanner` `BLADE_UNGUARDED_ADMIN_ACTION` is disabled by default because Blade authorization hints are heuristic and may be noisy. CI Usage -------- [](#ci-usage) Use score-based gating: ``` php artisan preflight:audit --format=json --output=storage/app/preflight-report.json --fail-under=80 ``` Use severity-based gating: ``` php artisan preflight:audit --fail-on-severity=critical ``` Generate SARIF for GitHub Code Scanning: ``` php artisan preflight:audit --format=sarif --output=storage/app/preflight.sarif --fail-on-severity=critical ``` An example GitHub Code Scanning workflow is included at [.github/workflows/preflight.yml.example](.github/workflows/preflight.yml.example). Baseline Management ------------------- [](#baseline-management) Baselines help teams adopt Preflight on existing projects without failing CI on every reviewed historical finding. Generate a baseline: ``` php artisan preflight:baseline generate php artisan preflight:audit --baseline ``` Show the current baseline: ``` php artisan preflight:baseline show ``` Remove entries for issues that have been fixed: ``` php artisan preflight:baseline prune ``` Clear the baseline: ``` php artisan preflight:baseline clear --force ``` Run while ignoring baseline findings: ``` php artisan preflight:audit --use-baseline ``` Recommended first-time flow: ``` php artisan preflight:audit php artisan preflight:baseline generate php artisan preflight:audit --use-baseline --fail-on-severity=critical ``` CI can enforce that no new unbaselined issues were introduced: ``` php artisan preflight:baseline show --fail-on-new ``` Review baseline changes before committing them. Rule Configuration ------------------ [](#rule-configuration) Rules can be disabled or have their severity changed in `config/preflight.php`: ``` 'rules' => [ 'ROUTE_NO_MIDDLEWARE' => [ 'enabled' => false, ], 'REQUEST_AUTHORIZE_ALWAYS_TRUE' => [ 'enabled' => true, 'severity' => 'medium', ], ], ``` Disabled rules are removed before reporting, scoring, baselines, SARIF, and CI gates. Severity overrides affect reports, score calculation, `--fail-on-severity`, and SARIF levels. Scanner Options --------------- [](#scanner-options) Scanner behavior can be tuned without disabling entire rules: ``` 'scanners' => [ 'routes' => [ 'enabled' => true, 'options' => [ 'auth_middleware_keywords' => ['auth', 'auth:sanctum', 'tenant-auth'], ], ], ], ``` Documentation ------------- [](#documentation) - [Configuration](docs/configuration.md) - [CI](docs/ci.md) - [Commands](docs/commands.md) - [Changed files](docs/changed-files.md) - [Examples](docs/examples.md) - [Explainability](docs/explainability.md) - [Fix examples](docs/fixes.md) - [False positives](docs/false-positives.md) - [Limitations](docs/limitations.md) - [Rules](docs/rules.md) - [Release checklist](docs/release-checklist.md) Limitations ----------- [](#limitations) Preflight is honest about what it is and is not: - It does not replace a professional security review. - It may produce false positives. - It does not guarantee a project is secure. - It does not perform dependency vulnerability database scanning. - It does not execute application code or perform runtime testing. - It uses static and convention-based checks, so confidence and false-positive guidance should be reviewed alongside severity. Roadmap ------- [](#roadmap) - More scanner accuracy improvements. - More framework-specific checks. - Stable v1.0 rule API. Contributing ------------ [](#contributing) Contributions are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md). Before submitting a pull request, run: ``` composer validate --strict vendor/bin/phpunit ``` Security -------- [](#security) Please report security concerns privately. See [SECURITY.md](SECURITY.md). License ------- [](#license) Preflight is open-sourced software licensed under the [MIT license](LICENSE). ### Health Score 36 — LowBetter than 79% of packages Maintenance85 Actively maintained with recent releases Popularity4 Limited adoption so far Community6 Small or concentrated contributor base Maturity41 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~0 days Total 7 Last Release 76d ago ### Community Maintainers ![](https://avatars.githubusercontent.com/u/92610232?v=4)[Md Fahim Tayebee](/maintainers/ftayebee)[@ftayebee](https://github.com/ftayebee) --- Top Contributors [![ftayebee](https://avatars.githubusercontent.com/u/92610232?v=4)](https://github.com/ftayebee "ftayebee (9 commits)") --- Tags laravelstatic analysisroutessecurityAuditpermissionsciscannersarif ### Code Quality TestsPHPUnit ### Embed Badge ![Health badge](/badges/fahimtayebee-preflight/health.svg) ``` [![Health](https://phpackages.com/badges/fahimtayebee-preflight/health.svg)](https://phpackages.com/packages/fahimtayebee-preflight) ``` ### Alternatives [laravel/sail Docker files for running a basic Laravel application. 1.9k205.7M1.3k](/packages/laravel-sail)[laravel/ai The official AI SDK for Laravel. 1.0k3.2M246](/packages/laravel-ai)[laravel/mcp Rapidly build MCP servers for your Laravel applications. 77922.3M186](/packages/laravel-mcp)[laravel/surveyor Static analysis tool for Laravel applications. 86121.4k14](/packages/laravel-surveyor)[masterix21/laravel-licensing Laravel licensing package with polymorphic assignment to any model, activation keys, expirations/renewals, and seat control via LicenseUsage. Supports offline verification with public-key–signed tokens, a CLI to generate/rotate/revoke keys, and an extensible architecture via config and contracts. 1613.3k4](/packages/masterix21-laravel-licensing)[tomshaw/electricgrid A feature-rich Livewire package designed for projects that require dynamic, interactive data tables. 119.4k](/packages/tomshaw-electricgrid) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)