PHPackages vinceamstoutz/symfony-security-auditor - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Testing & Quality](/categories/testing) 4. / 5. vinceamstoutz/symfony-security-auditor ActiveSymfony-bundle[Testing & Quality](/categories/testing) vinceamstoutz/symfony-security-auditor ====================================== AI-powered multi-agent security auditor for Symfony applications β€” provider-agnostic via symfony/ai 1.12.0(1mo ago)69836β€”0%[1 issues](https://github.com/vinceAmstoutz/symfony-security-auditor/issues)[1 PRs](https://github.com/vinceAmstoutz/symfony-security-auditor/pulls)MITPHPPHP >=8.3CI passing Since May 24Pushed 3w agoCompare [ Source](https://github.com/vinceAmstoutz/symfony-security-auditor)[ Packagist](https://packagist.org/packages/vinceamstoutz/symfony-security-auditor)[ RSS](/packages/vinceamstoutz-symfony-security-auditor/feed)WikiDiscussions main Synced 3w ago READMEChangelog (10)Dependencies (60)Versions (27)Used By (0) Symfony Security Auditor ======================== [](#symfony-security-auditor) [![CI](https://github.com/vinceamstoutz/symfony-security-auditor/actions/workflows/ci.yaml/badge.svg)](https://github.com/vinceamstoutz/symfony-security-auditor/actions/workflows/ci.yaml)[![codecov](https://camo.githubusercontent.com/e76f032b94a517828c5112f0681227e423f4b903f2d3be21c8f48c56a19de9ab/68747470733a2f2f636f6465636f762e696f2f67682f76696e6365616d73746f75747a2f73796d666f6e792d73656375726974792d61756469746f722f6272616e63682f6d61696e2f67726170682f62616467652e737667)](https://codecov.io/gh/vinceamstoutz/symfony-security-auditor)[![Mutation testing badge](https://camo.githubusercontent.com/70643bb5954271f65e0adff58e9c5f592451c0dc4518f54a2b472d492f0815fc/68747470733a2f2f696d672e736869656c64732e696f2f656e64706f696e743f7374796c653d666c61742675726c3d687474707325334125324625324662616467652d6170692e737472796b65722d6d757461746f722e696f2532466769746875622e636f6d25324676696e6365416d73746f75747a25324673796d666f6e792d73656375726974792d61756469746f722532466d61696e)](https://dashboard.stryker-mutator.io/reports/github.com/vinceAmstoutz/symfony-security-auditor/main)[![Total Downloads](https://camo.githubusercontent.com/e554551aab83867b9dd7743fd9a770e7a64ec9bf0c3a00b20664c2e75be800a6/68747470733a2f2f706f7365722e707567782e6f72672f76696e6365616d73746f75747a2f73796d666f6e792d73656375726974792d61756469746f722f646f776e6c6f616473)](https://packagist.org/packages/vinceamstoutz/symfony-security-auditor)[![PHP 8.3+](https://camo.githubusercontent.com/c8d8dad6beb757a2b8acba331d16140813699543b88a37af0a81f20bd35f61de/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f5048502d382e332532422d626c7565)](composer.json)[![Symfony 7.4+](https://camo.githubusercontent.com/18d244ff55bdd63a6f0a7018b0a5c195c2c1cd904559bf839bc2fa8aff90734a/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f53796d666f6e792d372e342532422d626c61636b)](composer.json)[![License: MIT](https://camo.githubusercontent.com/fdf2982b9f5d7489dcf44570e714e3a15fce6253e0cc6b5aa61a075aac2ff71b/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c6963656e73652d4d49542d79656c6c6f772e737667)](https://opensource.org/licenses/MIT) AI-powered, multi-agent security auditor for Symfony applications. An adversarial **Attacker βš” Reviewer** loop catches the application-level flaws SAST tools miss. Provider-agnostic via [`symfony/ai`](https://symfony.com/doc/current/ai/index.html). [![Symfony Security Auditor](assets/banner.webp?raw=true)](assets/banner.webp?raw=true) Why this auditor? ----------------- [](#why-this-auditor) Traditional PHP static analysis tools (PHPStan, Psalm) catch type errors. Static SAST tools (Psalm Security, Progpilot) follow taint flows but cannot reason about business logic, missing authorization, or multi-file attack chains. Dependency scanners (Dependabot, Renovate, Snyk) only flag known CVEs in third-party packages. This auditor runs alongside them, **targeting the application-level logic flaws they cannot see**. Side-by-side comparison with PHPStan, Psalm, Progpilot, Dependabot, and Snyk: [FAQ](docs/faq.md#comparisons). What it does ------------ [](#what-it-does) An adversarial **Attacker** agent hunts for vulnerabilities; a skeptical **Reviewer** agent culls false positives over up to three iterations β€” then emits a validated report in console, JSON, SARIF, HTML, or Markdown. πŸ”€ **Pipeline**: Ingestion β†’ Mapping β†’ Audit (Attacker βš” Reviewer) β†’ Report. See it in action ---------------- [](#see-it-in-action) ### `--dry-run` mode [](#--dry-run-mode) [![Dry run β€” token and cost estimate with no LLM calls](assets/dry-run.gif?raw=true)](assets/dry-run.gif?raw=true) Scans files and estimates token usage and cost without calling the LLM. Use this to gauge cost before committing to a full audit. ``` bin/console audit:run --dry-run ``` No LLM calls are made; exit code is always `0`. ### Console mode [](#console-mode) [![Live audit β€” the Attacker vs Reviewer feed streaming to the validated report](assets/demo.gif?raw=true)](assets/demo.gif?raw=true) While the pipeline runs, the audit narrates itself live β€” an attack-surface overview, each finding streamed (color-coded by severity in a terminal) the moment the Attacker flags it, per-chunk timing, and a reviewer tally. In CI or any non-TTY output it degrades to clean, append-only lines (no bar, no ANSI codes). Progress is suppressed for `--format=json/sarif` to stdout and for `--dry-run`. The full report renders the same way in console, JSON, SARIF, HTML, and Markdown β€” see [CLI reference](docs/configuration.md#cli-reference) and [output formats](docs/ci.md#output-formats-reference). Getting Started --------------- [](#getting-started) ### 1. Install β€” Symfony Flex wires everything [](#1-install--symfony-flex-wires-everything) ``` composer require --dev vinceamstoutz/symfony-security-auditor ``` The official [Flex recipe](https://github.com/symfony/recipes-contrib/tree/main/vinceamstoutz/symfony-security-auditor)registers the bundle (`dev`/`test`) and drops a pre-configured `config/packages/symfony_security_auditor.yaml`. Not using Flex? See [Manual setup](docs/configuration.md#manual-setup-without-flex). ### 2. Install a platform bridge [](#2-install-a-platform-bridge) ``` # Anthropic shown composer require symfony/ai-anthropic-platform ``` Full list of supported providers: [Configuration β†’ Supported platforms](docs/configuration.md#supported-platforms). ### 3. Configure the platform [](#3-configure-the-platform) ``` # config/packages/ai.yaml (or e.g. config/packages/ai_anthropic_platform.yaml) ai: platform: anthropic: api_key: '%env(ANTHROPIC_API_KEY)%' ``` ### 4. Adjust the auditor config [](#4-adjust-the-auditor-config) The Flex recipe already created this file β€” pick your model: ``` # config/packages/symfony_security_auditor.yaml symfony_security_auditor: model: 'claude-opus-4-8' ``` Optionally pick a one-knob preset β€” `fast`, `balanced` (default), or `thorough`: ``` # config/packages/symfony_security_auditor.yaml symfony_security_auditor: profile: 'fast' ``` A profile only fills the keys you leave unset β€” any explicitly configured key always wins. See [Cost & Performance](docs/cost-and-performance.md) for exactly what each profile sets. ### 5. Run [](#5-run) ``` # audit the current directory bin/console audit:run # or point at another project bin/console audit:run /path/to/your/symfony/project ``` Want JSON, SARIF, HTML, or Markdown instead? Add `--format json --output report.json`, `--format sarif --output report.sarif`, `--format html --output report.html`, or `--format markdown --output report.md`. See [CLI reference](docs/configuration.md#cli-reference). Estimate cost before running: ``` bin/console audit:run --dry-run ``` Warning **Audit reports list your application's vulnerabilities.** On a **public repository**, CI artifacts are publicly downloadable β€” storing the report exposes your attack surface. Prefer GitHub Code Scanning (SARIF, restricted to collaborators), private storage (S3/GCS with IAM), or notification-only. See [Report Visibility on Public Repositories](docs/ci.md#report-visibility-on-public-repositories). Tip Schedule the audit as a nightly CI job β€” the multi-agent LLM loop can take minutes, so blocking PRs on it hurts productivity. [CI Integration](docs/ci.md) has ready-to-copy GitHub Actions and GitLab CI schedules and a split-model config to [control API costs](docs/ci.md#managing-llm-costs). For **dependency CVEs**, pair it with [Dependabot](https://docs.github.com/en/code-security/dependabot)or [Renovate](https://docs.renovatebot.com/) β€” this auditor targets the application-level logic flaws those scanners cannot see. Features -------- [](#features) - **Multi-agent loop** β€” adversarial Attacker + skeptical Reviewer cut false positives across up to 3 iterations, with confirmed findings fed back so later iterations generalize patterns instead of re-finding the same bugs. - **39 vulnerability types** covering OWASP-aligned categories: Injection, Broken Access Control, Logic Flaws, Symfony-specific, Data Exposure, Cryptographic β€” including the modern Symfony 7.x/8.x surface (Authenticators, Messenger handlers, Webhooks, Serializer denormalizers, Schedules, RateLimiter, Mailer, cache poisoning). - **Symfony-aware** β€” understands Controllers, Voters, Forms, Firewalls, Routes, `#[IsGranted]`, `denyAccessUnlessGranted`, `#[MapRequestPayload]`, Twig/Live Components, and surfaces controllers without proper access checks. - **Feature-based chunking** β€” groups a controller with its entity, repository, form, voter, and templates so the Attacker can follow data flow across files. - **Deterministic pre-scan** β€” a zero-token risk-marker pass flags concrete locations (unserialize, `|raw`, hardcoded secrets, unsafe Doctrine, …) to focus the LLM; optional **lean mode** drops marker-free files to cut tokens. - **Diff mode** β€” `audit:run --since=main` audits only changed files for fast pull-request CI. - **Cross-file investigation tools** β€” Attacker (and optionally Reviewer) can `read_file`, `grep`, `list_files`, and `lookup_advisory` (zero-config live CVE lookups via `composer audit`, backed by Packagist + GitHub Security Advisories). - **One-knob profiles** β€” `fast`, `balanced`, and `thorough` preset the cost/speed/depth levers in a single line; any explicit key still wins. - **Tunable for speed & cost** β€” split-model (powerful Attacker + cheap Reviewer, ~20Γ— cheaper), concurrent Attacker **and** Reviewer calls (`attacker_max_concurrent` / `reviewer_max_concurrent`), Anthropic prompt caching on by default (~90% input-token discount), content-hash caching that skips identical chunks, cheapβ†’expensive escalation, and code slicing. - **Secret-safe by default** β€” credential-shaped strings are scrubbed from file content **before** it reaches the LLM (see [Security by design](#security-by-design)). - **Rate-limit aware** β€” reactive retry with `Retry-After`-aware exponential backoff plus an optional proactive token-bucket limiter keep you inside provider quotas (see [Cost & Performance](docs/cost-and-performance.md#avoiding-rate-limits-429)). - **PoC synthesis** β€” optionally attach a concrete, copy-pasteable reproduction (curl/console/payload) to every high-severity finding. - **Five output formats** β€” `console`, `json`, `sarif` (GitHub Code Scanning / GitLab Security Dashboard), `html` (self-contained, shareable), and `markdown`(PR-friendly). Baseline suppression: `--generate-baseline` accepts known findings, `--baseline` drops them from the report and exit code so only new findings fail CI. - **CI-ready** β€” a reusable [GitHub Action](https://github.com/marketplace/actions/symfony-security-auditor)(`uses: vinceamstoutz/symfony-security-auditor@1.12.0`) plus GitLab CI templates, with SARIF upload to Code Scanning. See [CI Integration](docs/ci.md). - **DDD architecture** β€” strict layering and a sole `LLMClientInterface` seam let you plug in custom providers, agents, stages, advisory feeds, or report formats. Security by design ------------------ [](#security-by-design) The auditor is conservative about what leaves your machine: - **Secrets are scrubbed before they leave your machine.** With `scan.secret_scrubbing.enabled: true` (the default), credential-shaped strings are redacted from file content *before* it reaches the LLM: AWS / GitHub / Stripe / Slack / Google API keys, JWTs, PEM private keys, env-style credential assignments, and connection-string URIs with embedded credentials (`postgres://user:pass@host`). Add project-specific shapes with `scan.secret_scrubbing.additional_patterns`. - **The cache never stores your source.** The filesystem cache keys LLM *responses* by content hash β€” no plaintext source code is written to `cache.dir`. - **You choose where the code goes.** Source is sent only to the provider you wire in `ai.yaml`. For zero third-party exposure, run fully offline with [Ollama](docs/configuration.md#supported-platforms) β€” nothing leaves your network. - **Reports are sensitive β€” they list your weak spots.** On public repos, prefer SARIF β†’ GitHub Code Scanning (collaborator-only) over downloadable CI artifacts. See [Report Visibility](docs/ci.md#report-visibility-on-public-repositories). Tuning & cost ----------------- [](#tuning--cost) Profiles (`fast` / `balanced` / `thorough`), split-model, concurrency, caching, budget caps, and `429` rate-limit handling are covered in **[Cost & Performance](docs/cost-and-performance.md)** β€” start with a profile, then override individual keys as needed. Supported Platforms ------------------- [](#supported-platforms) PlatformBridge packageKey env varAnthropic (Claude)`symfony/ai-anthropic-platform``ANTHROPIC_API_KEY`OpenAI`symfony/ai-open-ai-platform``OPENAI_API_KEY`OpenAI Responses API`symfony/ai-open-responses-platform``OPENAI_API_KEY`Azure OpenAI`symfony/ai-azure-platform``AZURE_OPENAI_API_KEY`Google Gemini`symfony/ai-gemini-platform``GEMINI_API_KEY`Google Vertex AI`symfony/ai-vertex-ai-platform`GCP credentialsAWS Bedrock`symfony/ai-bedrock-platform`AWS credentialsDeepSeek`symfony/ai-deep-seek-platform``DEEPSEEK_API_KEY`Mistral`symfony/ai-mistral-platform``MISTRAL_API_KEY`Meta (Llama)`symfony/ai-meta-platform``META_API_KEY`Ollama (local)`symfony/ai-ollama-platform`*(none)*Swapping providers requires only a `config/packages/ai.yaml` change β€” no PHP edits. Documentation ------------- [](#documentation) - [Configuration](docs/configuration.md) β€” every config key, all platforms, split-model, model options, CLI reference - [Cost & Performance](docs/cost-and-performance.md) β€” profiles, split-model, concurrency, caching, budgets, and rate-limit handling - [Architecture](docs/architecture.md) β€” DDD layers, pipeline, agent loop, domain model, design decisions - [CI Integration](docs/ci.md) β€” scheduled GitHub Actions & GitLab CI, SARIF upload, cost management - [Extending](docs/extending.md) β€” custom LLM clients, agents, pipeline stages, report formats - [FAQ](docs/faq.md) β€” accuracy, cost, privacy, model picks, comparisons - [Troubleshooting](docs/troubleshooting.md) β€” empty reports, LLM errors, composer audit failures, cache issues - [Contributing](CONTRIBUTING.md) β€” dev setup, Docker workflow, QA, PR checklist FAQ --- [](#faq) **How much does an audit cost?** Depends on project size and model. A medium Symfony app (~150 files) on Claude Opus + Haiku split-model with prompt caching enabled costs roughly $0.50 per nightly run. See [CI β†’ Managing LLM Costs](docs/ci.md#managing-llm-costs). **Does it send my code to the cloud?** Only to the LLM provider you configure, and credential-shaped strings are scrubbed first (see [Security by design](#security-by-design)). For zero-cloud operation, use the [Ollama local platform](docs/configuration.md#supported-platforms). Full FAQ β€” privacy, false positives, model picks, comparisons: [docs/faq.md](docs/faq.md). Contributing ------------ [](#contributing) Contributions welcome, please refer to [CONTRIBUTING.md](CONTRIBUTING.md). Security -------- [](#security) Found a vulnerability **in the auditor itself**? Do **not** open a public issue. Report privately via [GitHub Security Advisories](https://github.com/vinceamstoutz/symfony-security-auditor/security/advisories/new). See [SECURITY.md](SECURITY.md). License ------- [](#license) [MIT](LICENSE) β€” Copyright Β© Vincent Amstoutz ### Health Score 52 β€” FairBetter than 96% of packages Maintenance94 Actively maintained with recent releases Popularity31 Limited adoption so far Community8 Small or concentrated contributor base Maturity59 Maturing project, gaining track record Bus Factor1 Top contributor holds 94% of commits β€” single point of failure How is this calculated?**Maintenance (25%)** β€” Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** β€” Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** β€” Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** β€” Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~1 days Total 25 Last Release 38d ago ### Community Maintainers ![](https://avatars.githubusercontent.com/u/46444652?v=4)[ Vincent Amstoutz](/maintainers/vinceAmstoutz)[@vinceAmstoutz](https://github.com/vinceAmstoutz) --- Top Contributors [![vinceAmstoutz](https://avatars.githubusercontent.com/u/46444652?v=4)](https://github.com/vinceAmstoutz "vinceAmstoutz (79 commits)")[![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4)](https://github.com/dependabot[bot] "dependabot[bot] (5 commits)") --- Tags aiauditllmsmulti-agentowasppenetration-testingphpsastsecuritysecurity-auditsecurity-toolsstatic-analysissymfonysymfony-bundlevulnerability-scannerphptestingsymfonybundledevstatic analysissecurityaiAuditowaspllmvulnerabilitySASTMulti-agentpenetration-testing ### Code Quality TestsPHPUnit Static AnalysisPHPStan, Rector Code StylePHP CS Fixer Type Coverage Yes ### Embed Badge ![Health badge](/badges/vinceamstoutz-symfony-security-auditor/health.svg) ``` [![Health](https://phpackages.com/badges/vinceamstoutz-symfony-security-auditor/health.svg)](https://phpackages.com/packages/vinceamstoutz-symfony-security-auditor) ``` ### Alternatives [shopware/core Shopware platform is the core for all Shopware ecommerce products. 585.6M600](/packages/shopware-core)[sulu/sulu Core framework that implements the functionality of the Sulu content management system 1.3k1.4M215](/packages/sulu-sulu)[contao/core-bundle Contao Open Source CMS 1231.6M2.8k](/packages/contao-core-bundle)[shopware/platform The Shopware e-commerce core 3.4k1.5M3](/packages/shopware-platform)[open-dxp/opendxp Content & Product Management Framework (CMS/PIM) 9421.6k64](/packages/open-dxp-opendxp)[typo3/cms TYPO3 CMS is a free open source Content Management Framework initially created by Kasper Skaarhoj and licensed under GNU/GPL. 1.2k1.9M122](/packages/typo3-cms) PHPackages Β© 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)