PHPackages sdpayhub/laravel-wraith - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. sdpayhub/laravel-wraith ActiveLibrary sdpayhub/laravel-wraith ======================= Point-in-time static (and opt-in dynamic) diagnostic analysis for Laravel applications — configuration, schema, security, and codebase. 00PHPCI passing Pushed todayCompare [ Source](https://github.com/shukladeepak08/laravel-wraith)[ Packagist](https://packagist.org/packages/sdpayhub/laravel-wraith)[ RSS](/packages/sdpayhub-laravel-wraith/feed)WikiDiscussions main Synced today READMEChangelog (3)DependenciesVersionsUsed By (0) Laravel Wraith ============== [](#laravel-wraith) Inspect your Laravel app **right now** — config, security, database schema, routes, models — and get a scored list of problems with suggested fixes. ``` composer require sdpayhub/laravel-wraith --dev php artisan wraith ``` Works with **Laravel 8–12** (PHP 7.3+). --- Quick start (3 steps) --------------------- [](#quick-start-3-steps) ### 1. Install [](#1-install) ``` composer require sdpayhub/laravel-wraith --dev ``` Optional (only if you want to change weights / thresholds): ``` php artisan vendor:publish --tag=wraith-config ``` ### 2. Run [](#2-run) ``` php artisan wraith ``` That’s it. Wraith scans your app once and prints a report in the terminal. ### 3. Read the report [](#3-read-the-report) You’ll see something like: ``` Wraith — Laravel diagnostic audit ───────────────────────────────── Overall score: 77 / 100 ← higher is healthier (100 = clean) Category scores: application 100 security 70 ← this category lost points database 85 How to read this • Score starts at 100 per category; each issue subtracts points • critical −25 · high −15 · medium −8 · low −3 · info −0 • Fix critical/high first [CRITICAL] (1) • [app.debug_in_production] APP_DEBUG is enabled in production. Why: Exposes stack traces and secrets to users. Fix: Set APP_DEBUG=false in .env Auto-fixable: yes (--fix) [HIGH] (2) • [security.session_insecure] Session cookies are not marked secure... Why: ... Fix: ... 3 finding(s) in 412 ms Next steps • Fix critical/high issues first • Preview safe fixes: php artisan wraith --fix --dry-run • Shareable HTML: php artisan wraith --html • CI gate: php artisan wraith --ci --fail-on=high ``` What you seeWhat it means**Overall score**Weighted health score for this run (0–100)**Category scores**Score per area (security, database, …)**`[CRITICAL]` / `[HIGH]` …**How urgent the issue is**Why**Why it matters**Fix**What to do**Auto-fixable: yes**Wraith can apply a safe mechanical fix with `--fix`--- Common commands --------------- [](#common-commands) GoalCommandFull audit (default)`php artisan wraith`Only security + database`php artisan wraith --only=security,database`Skip routes`php artisan wraith --except=routes`Score numbers only`php artisan wraith --score`JSON (for scripts)`php artisan wraith --json`HTML file you can open/share`php artisan wraith --html`Markdown`php artisan wraith --markdown`Fail CI on high+ issues`php artisan wraith --ci --fail-on=high`Preview safe auto-fixes`php artisan wraith --fix --dry-run`Apply safe auto-fixes`php artisan wraith --fix`Undo last `--fix``php artisan wraith --restore`Live query patterns (opt-in)`php artisan wraith --dynamic`Categories: `application`, `security`, `configuration`, `database`, `eloquent`, `routes`, `performance`, `code_quality`, `dynamic`. --- What this is / isn’t -------------------- [](#what-this-is--isnt) This isThis is notA one-shot audit of config, schema, and codeTelescope / Pulse / continuous APMSomething you run locally or in CIA runtime health ping every minuteActionable findings with suggested fixesA replacement for PHPStan (it wraps it)**Out of scope:** `EXPLAIN` / query plans, lock contention, continuous latency, inventing indexes/eager loads, custom vulnerability databases. **`--dynamic` warning:** makes real GET requests to your app. Use on a disposable environment if unsure. --- Scoring (simple version) ------------------------ [](#scoring-simple-version) 1. Every category starts at **100**. 2. Each finding subtracts points by severity: SeverityPoints lostcritical25high15medium8low3info0 3. **Overall score** = weighted average of category scores. Security counts more (weight 2.0), database/dynamic 1.5, others 1.0. Change weights anytime in `config/wraith.php` after publishing the config. **CI note:** `--ci --fail-on=high` fails the build if any finding is high or worse — it does **not** use the 0–100 score as the fail gate. --- Safe auto-fix ------------- [](#safe-auto-fix) Only these mechanical fixes are supported (nothing “smart”): FixWhat it does`gitignore_env`Ensure `.env` is in `.gitignore``env_bool_normalize`Set an env key to `true`/`false``pint`Run Laravel PintAlways preview first: ``` php artisan wraith --fix --dry-run php artisan wraith --fix php artisan wraith --restore # if you need to undo ``` --- What Wraith checks ------------------ [](#what-wraith-checks) ### Application [](#application) - Debug mode, app key, timezone, storage link, config/route cache in production - Writable `storage/` + `bootstrap/cache` - Scheduled tasks defined (cron reminder for production) ### Security [](#security) - Session cookies, HTTPS `APP_URL`, `.env` exposure - `composer audit` + npm/pnpm audit; gitleaks suggestion - **Telescope / Horizon / Pulse / Debugbar** present in production - **Trusted proxies** empty/missing (Cloudflare/ALB footgun) - **CORS** `*` (especially with credentials) - **Sanctum ↔ SESSION\_DOMAIN** alignment for SPAs - **Executable uploads** under `storage/app/public` - **Abandoned Composer packages** ### Configuration [](#configuration) - Missing env keys, bad bool values - **`.env.example` drift** vs `config/*.php` - **Composer PHP platform / constraint** vs runtime PHP ### Database [](#database) - Pending migrations, missing `down()`, PKs/FKs/indexes, collation - **Secondary DB connections** using localhost / empty password in production ### Eloquent [](#eloquent) - Mass assignment, soft deletes mismatches, weak missing-casts signals ### Routes [](#routes) - Duplicates, unnamed routes, closures in production, API throttling - **Login / password-reset / OTP routes without throttle** ### Performance [](#performance) - `sync`/`file`/`array` drivers, OPcache, assets, Horizon/Octane config - **Mail = log/array**, **filesystem = local**, noisy single-file logs in production - **Redis prefix** collisions / empty prefixes - **Queue retry\_after vs timeout**, missing **failed\_jobs** table ### Code quality [](#code-quality) - Wraps PHPStan & Pint when installed ### Dynamic (opt-in `--dynamic`) [](#dynamic-opt-in---dynamic) - N+1 / duplicate / slow query patterns via route replay --- CI example ---------- [](#ci-example) ``` - name: Wraith audit run: php artisan wraith --ci --fail-on=high --json ``` --- Compatibility ------------- [](#compatibility) LaravelPHP87.3–8.198.0–8.2108.1+11–128.2+--- License ------- [](#license) MIT — [LICENSE.md](LICENSE.md) · [CHANGELOG.md](CHANGELOG.md) · [CONTRIBUTING.md](CONTRIBUTING.md) · [SECURITY.md](SECURITY.md) ### Health Score 20 — LowBetter than 12% of packages Maintenance65 Regular maintenance activity Popularity0 Limited adoption so far Community6 Small or concentrated contributor base Maturity8 Early-stage or recently created project Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Community Maintainers ![](https://www.gravatar.com/avatar/1e23005088620553822aaa9966fca22d969c15c6a339444d4feeeb3ab92ee0c6?d=identicon)[dshukla0806](/maintainers/dshukla0806) --- Top Contributors [![shukladeepak08](https://avatars.githubusercontent.com/u/194630609?v=4)](https://github.com/shukladeepak08 "shukladeepak08 (5 commits)") ### Embed Badge ![Health badge](/badges/sdpayhub-laravel-wraith/health.svg) ``` [![Health](https://phpackages.com/badges/sdpayhub-laravel-wraith/health.svg)](https://phpackages.com/packages/sdpayhub-laravel-wraith) ``` PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)