DepWarden's free PHP SAST scanner checks PHP source code against 45 security rules (including 5 Laravel-specific rules). Every rule maps to a CWE and the findings span 8 OWASP Top 10 categories, and every finding comes with an explanation, a fix and a before-and-after example. Paste a file, upload a zip or connect a repository: no account, and the results stay in a private, session-isolated workspace.
PHP still powers a large part of the web, from Laravel applications to long-lived custom sites. Old habits (SQL built by concatenation, files included from user input, loose comparisons) are the recurring problems.
45 rules cover 32 distinct weakness types (9 critical, 25 high, 9 medium and 2 low severity).
| What it checks | Rules | Examples |
|---|---|---|
| Weak cryptography | 13 | MD5 used for password hashing; TLS certificate validation disabled — trust all certs; DES or 3DES cipher used |
| Injection (SQL, command, code) | 10 | OS command injection; preg_replace with /e modifier (code execution); Dynamic code execution (eval) |
| Insecure configuration | 6 | CORS: Access-Control-Allow-Credentials with wildcard origin; Laravel APP_DEBUG=true; GraphQL introspection enabled in production |
| Authentication and sessions | 3 | JWT none algorithm accepted; Session fixation via user-supplied session ID; Token or secret compared with non-constant-time equality |
| Hardcoded secrets | 3 | Hardcoded symmetric encryption key; JWT signed with weak or hardcoded secret; API key or token in URL query string |
| Mass assignment | 2 | Laravel mass-assignment without fillable guard; Laravel Model::unguard() disables mass-assignment protection |
| Privacy and data leaks | 2 | Sensitive data written to application log; var_dump / print_r / var_export in production code |
| Server-side request forgery | 2 | SSRF — HTTP request to user-controlled URL; SSRF via file_get_contents / curl with user URL |
| Access control | 1 | Open redirect via Location header |
| File handling | 1 | File upload without type or size restriction |
| Insecure deserialization | 1 | PHP unserialize on user-supplied data |
| Open redirect | 1 | Open redirect to user-controlled URL |
A shell-executing function is called with untrusted input.
Vulnerable:
system('convert ' . $_GET['file']);Fixed:
system('convert ' . escapeshellarg($_GET['file']));Avoid shell execution with user input; use escapeshellarg() and an allowlist.
unserialize() on attacker-controlled input enables PHP object injection / RCE via gadget chains.
Vulnerable:
$data = unserialize($_POST['data']);Fixed:
$data = json_decode($_POST['data'], true);Never unserialize untrusted data. Use JSON for data exchange; if serialization is required, use a signed, verified format.
APP_DEBUG=true exposes stack traces, environment variables and configuration values to users.
Vulnerable:
APP_DEBUG=trueFixed:
APP_DEBUG=falseSet APP_DEBUG=false in production .env.
- uses: Rushabh5000/depwarden-action@v1
with:
sast-dir: src
sast-fail-on: high
env:
APP_API_KEY: ${{ secrets.APP_API_KEY }}DepWarden's SAST engine uses pattern rules and taint-aware rules that require untrusted input to reach a dangerous call. It is not a full cross-file dataflow engine, so a bug that only appears when data crosses several files can be missed, and every static analyser reports some false positives. Treat findings as leads: review them, fix the real ones and suppress the rest with a written reason. SAST covers the code you write; for the packages you import, run software composition analysis too.
Yes. DepWarden's PHP scanner is free in the browser with no account: paste code, upload a zip or connect a repository. Running SAST from CI through an API key needs a plan that includes SAST.
.php, .phtml. Configuration and secret-bearing files such as .env and key files are also checked for hardcoded credentials, whatever language the project uses.
Each finding names the weakness (CWE), explains why the code is risky, shows a vulnerable and a fixed version of the pattern, and gives the remediation. Fix the code, then scan again to confirm the finding is gone.
Other languages: Python, Java, JavaScript and TypeScript, Go (Golang), C#, Ruby, Kotlin, Swift, and secret scanning. Compare the options in free SAST tools compared, or start with what is SAST and SAST vs SCA.