Laravel Security Package

A Laravel package for automated monitoring of security vulnerabilities and outdated packages in Composer and NPM dependencies.

Installation

You can install the package via composer:

composer require xchimx/laravel-security

You can publish and run the migrations with:

php artisan vendor:publish --tag="security-migrations"
php artisan migrate

You can publish the config file with:

php artisan vendor:publish --tag="security-config"

You can publish the views, or you add this line to your app.css:

@source '../../../../vendor/xchimx/laravel-security/resources/views/**/*.blade.php';

Customize the config/security.php file according to your requirements or set the corresponding ENV variables:

# App Info
APP_NAME=MyApp
APP_URL=https://myapp.com

# Security Audit
SECURITY_AUDIT_ENABLED=true
SECURITY_AUDIT_TIME=02:00
SECURITY_AUDIT_COMPOSER=true
SECURITY_AUDIT_NPM=true

# Outdated Checks
SECURITY_OUTDATED_ENABLED=true
SECURITY_OUTDATED_TIME=03:00
SECURITY_OUTDATED_COMPOSER=true
SECURITY_OUTDATED_NPM=true

# Notifications
SECURITY_NOTIFY_USER_ID=1
SECURITY_NOTIFICATIONS_USER_MODEL=App\Models\User
SECURITY_NOTIFICATIONS_ROUTE=admin.security
SECURITY_NOTIFY_MAIL=true
SECURITY_NOTIFY_DATABASE=true
SECURITY_NOTIFY_DATABASE_MAIL=false
SECURITY_NOTIFY_SLACK=false
SECURITY_MAIL_TO=admin@example.com
SLACK_BOT_USER_OAUTH_TOKEN=xxx-xxx-xxx
SLACK_BOT_USER_DEFAULT_CHANNEL="#security-alerts"

Optionally, you can publish the views using

php artisan vendor:publish --tag="security-views"

Usage

The package automatically registers the following tasks in the Laravel Scheduler:

• Security Audit: Daily at 02:00 (configurable)
• Outdated Check: Weekly on Mondays at 3:00 a.m. (configurable)

Ensure that the Laravel Scheduler is running:

* * * * * cd /path-to-your-project && php artisan schedule:run >> /dev/null 2>&1

Manual Usage

# Perform security audit
php artisan security:audit

# Check Composer only
php artisan security:audit --composer

# Check NPM only
php artisan security:audit --npm

# Check for outdated packages
php artisan security:outdated

# Check Composer only
php artisan security:outdated --composer

# Check NPM only
php artisan security:outdated --npm

Dashboard Component

Integrate the Security Dashboard Component into your Blade views:

<x-security-security-dashboard />

Programmatic Access

use Xchimx\LaravelSecurity\Models\SecurityAudit;

// Retrieve latest Composer audit
$audit = SecurityAudit::getLatestAudit('composer');

// Latest outdated check for NPM
$outdated = SecurityAudit::getLatestOutdated('npm');

// All audits with issuesen
$issues = SecurityAudit::withIssues()->get();

// Audits from the last 7 days
$recent = SecurityAudit::where('executed_at', '>=', now()->subDays(7))->get();

Notifications

Database notifications

Database notifications are sent to the user ID configured in SECURITY_NOTIFY_USER_ID. If the user has an email address and SECURITY_NOTIFY_DATABASE_MAIL is set to true, the notification is also sent to that address

When database notifications are enabled, notifications are stored in the notifications table. This requires the standard Laravel notifications migration:

SECURITY_NOTIFY_USER_ID=1 #User ID
SECURITY_NOTIFICATIONS_USER_MODEL=App\Models\User #User Model
SECURITY_NOTIFY_DATABASE=true #Set database notification to enabled
SECURITY_NOTIFY_DATABASE_MAIL=false #User receives database notification without email. Set to “true” if an email should also be sent.

php artisan notifications:table
php artisan migrate

Email notifications

Emails are sent to the address configured in SECURITY_MAIL_TO. You can separate multiple addresses with commas:

SECURITY_MAIL_TO=admin@example.com,security@example.com

Slack notifications

Configure your Slack token:

SECURITY_NOTIFY_SLACK=true
SLACK_BOT_USER_OAUTH_TOKEN=xxx-xxx-xxx
SLACK_BOT_USER_DEFAULT_CHANNEL="#security-alerts"

Data model

The security_audits table stores:

• type: 'audit' or 'outdated'
• source: 'composer' or 'npm'
• results: JSON with details about the issues found
• vulnerabilities_count: Number of security vulnerabilities
• outdated_count: Number of outdated packages
• has_issues: Boolean flag
• raw_output: Raw output of the command
• executed_at: Time of execution

Requirements

• PHP ^8.3
• Laravel ^13.0
• Composer (installed on the server)
• NPM (Optional if NPM packages are to be checked)

Testing

composer test

Changelog

Please see CHANGELOG for more information on what has changed recently.

Credits

• Tobias Schottstädt

License

The MIT License (MIT). Please see License File for more information.

Views

Dashboard

Mail Notification

Slack Notification Audit

Slack Notification Outdated