PHPackages                             laravelsecurityaudit/laravel-ai-lint - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. laravelsecurityaudit/laravel-ai-lint

ActivePhpstan-extension[Security](/categories/security)

laravelsecurityaudit/laravel-ai-lint
====================================

Static analysis for insecure AI wiring in Laravel apps: a scan command that finds AI provider keys leaked into tracked or client-reachable files, plus PHPStan rules that flag model output flowing into unsafe sinks and prompts built by concatenation. SARIF for CI.

v0.1.0(1mo ago)05↓50%MITPHPPHP ^8.2CI passing

Since Jun 28Pushed 1mo agoCompare

[ Source](https://github.com/laravelsecurityaudit/laravel-ai-lint)[ Packagist](https://packagist.org/packages/laravelsecurityaudit/laravel-ai-lint)[ Docs](https://github.com/laravelsecurityaudit/laravel-ai-lint)[ RSS](/packages/laravelsecurityaudit-laravel-ai-lint/feed)WikiDiscussions main Synced 2w ago

READMEChangelogDependencies (10)Versions (2)Used By (0)

Laravel AI Lint
===============

[](#laravel-ai-lint)

Static analysis for insecure AI wiring in a Laravel app. Two halves:

1. A scan command that finds AI provider keys leaked into tracked or browser-reachable files, plus other secrets, and fails CI.
2. A PHPStan extension that flags model output flowing into an unsafe sink and prompts built by string concatenation.

It is the static companion to `laravel-ai-egress-guard`: the egress guard catches leaks at runtime, AI Lint catches the dangerous wiring in source before it ships.

> This is an independent open-source package. It is not affiliated with, endorsed by, or sponsored by Laravel, Laravel LLC, or any AI provider.

Requirements
------------

[](#requirements)

- PHP 8.2+, Laravel 12 or 13
- PHPStan 2 (for the extension half)

Installation
------------

[](#installation)

```
composer require --dev laravelsecurityaudit/laravel-ai-lint
```

It depends on `laravelsecurityaudit/laravel-secret-scanner` for the detection engine. With `phpstan/extension-installer` present, the PHPStan rules register automatically; otherwise include the extension manually (see below).

The scan command (the funnel half)
----------------------------------

[](#the-scan-command-the-funnel-half)

```
php artisan ai-lint:scan
php artisan ai-lint:scan --min-severity=critical --format=sarif --output=ai-lint.sarif
```

It walks the configured paths (`app`, `config`, `routes`, `resources`, `database`, `public` by default), runs the secret rules over each file, and reports findings with their file and line. `secrets.ai_provider_key` fires on an OpenAI, Anthropic, or Google key found in a tracked file. When it lands under `resources/js`, `resources/views`, or `public`, that is the day-one mistake in AI-generated apps: the key is reachable by the browser.

Formats are `table`, `json`, and `sarif`. The command exits non-zero when any finding meets `--min-severity`, so it gates CI:

```
- run: php artisan ai-lint:scan --min-severity=critical --format=sarif --output=ai-lint.sarif
- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: ai-lint.sarif
```

The PHPStan rules (the static half)
-----------------------------------

[](#the-phpstan-rules-the-static-half)

Once installed (with `phpstan/extension-installer`, or by adding `vendor/laravelsecurityaudit/laravel-ai-lint/extension.neon` to your `phpstan.neon` `includes`), running PHPStan flags:

- `aiLint.llmOutputToUnsafeSink`: model output used directly inside an unsafe sink, e.g. `DB::raw($response->content)` or `exec($prism->asText()->text)` (OWASP LLM05).
- `aiLint.concatenatedPrompt`: a prompt built by concatenation or interpolation that mixes in dynamic data, e.g. `->withPrompt('Summarise: '.$input)` (OWASP LLM01).

The detected method, sink, and token lists live in the package's `extension.neon` service definitions; copy a definition into your own `phpstan.neon` to customise them.

These are lexical, single-expression checks: they catch the AI call inside the sink or prompt argument. Output that first travels through a variable, and deeper data flow, is exactly what the runtime egress guard and a manual audit are for. AI Lint is the cheap first gate, not a replacement for either.

Configuration
-------------

[](#configuration)

```
php artisan vendor:publish --tag=ai-lint-config
```

Set scanned paths, file extensions, client-reachable locations, and the active rules in `config/ai-lint.php`.

Testing
-------

[](#testing)

```
composer test
composer analyse
```

The Laravel Security Audit family
---------------------------------

[](#the-laravel-security-audit-family)

One detection engine, guarding every place data leaves your app.

PackageWhat it guards[laravel-secret-scanner](https://packagist.org/packages/laravelsecurityaudit/laravel-secret-scanner)Shared secret and PII detection engine (the core)[laravel-mail-guard](https://packagist.org/packages/laravelsecurityaudit/laravel-mail-guard)Outgoing Laravel mail[laravel-ai-egress-guard](https://packagist.org/packages/laravelsecurityaudit/laravel-ai-egress-guard)Outbound AI provider traffic (OpenAI, Anthropic, Gemini)**laravel-ai-lint** (this package)Static analysis: leaked AI keys and unsafe AI wiring[laravel-ai-circuit-breaker](https://packagist.org/packages/laravelsecurityaudit/laravel-ai-circuit-breaker)Runaway AI loops and spend[laravel-ai-ledger](https://packagist.org/packages/laravelsecurityaudit/laravel-ai-ledger)GDPR Article 30 processing ledger for AI trafficLicense
-------

[](#license)

The MIT License (MIT). See [LICENSE](LICENSE).

###  Health Score

35

—

LowBetter than 77% of packages

Maintenance90

Actively maintained with recent releases

Popularity4

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity36

Early-stage or recently created project

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

46d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/afa88251494388c616878c63f05e227db8524f18bb98f6b2e51b5788ec4cec25?d=identicon)[laravelsecurityaudit](/maintainers/laravelsecurityaudit)

---

Top Contributors

[![workaandrey](https://avatars.githubusercontent.com/u/1831403?v=4)](https://github.com/workaandrey "workaandrey (3 commits)")

---

Tags

PHPStanlaravelstatic analysissecurityaisecretsllm

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan

Code StyleLaravel Pint

### Embed Badge

![Health badge](/badges/laravelsecurityaudit-laravel-ai-lint/health.svg)

```
[![Health](https://phpackages.com/badges/laravelsecurityaudit-laravel-ai-lint/health.svg)](https://phpackages.com/packages/laravelsecurityaudit-laravel-ai-lint)
```

###  Alternatives

[larastan/larastan

Larastan - Discover bugs in your code without running it. A phpstan/phpstan extension for Laravel

6.5k60.6M10.3k](/packages/larastan-larastan)[laravel/ai

The official AI SDK for Laravel.

1.1k4.6M305](/packages/laravel-ai)[calebdw/larastan

Larastan - Discover bugs in your code without running it. A phpstan/phpstan extension for Laravel

16132.2k4](/packages/calebdw-larastan)[laravel/mcp

Rapidly build MCP servers for your Laravel applications.

79227.1M218](/packages/laravel-mcp)[neuron-core/neuron-laravel

Official Neuron AI Laravel SDK.

11747.5k1](/packages/neuron-core-neuron-laravel)[forjedio/inertia-table

Backend-driven dynamic tables for Laravel + Inertia.js

272.0k](/packages/forjedio-inertia-table)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)