samigitz / larasift

0.1.2 2026-09-18 13:05 UTC

Requires

• php: ^8.2
• composer-runtime-api: ^2.2
• ext-json: *
• nikic/php-parser: ^5.4
• symfony/console: ^7.2|^8.0
• symfony/finder: ^7.2|^8.0
• symfony/string: ^7.2|^8.0
• symfony/yaml: ^7.2|^8.0

Requires (Dev)

• laravel/pint: ~1.30.0
• phpstan/phpstan: ^2.1
• phpunit/phpunit: ^11.5

MIT

• Sampath Arachchige

• security
• laravel
• static analysis
• xss
• SAST
• security scanner

Published on Packagist.org on 2026-09-18 13:05 UTC

README

Find common security mistakes in Laravel code before they reach production.

LaraSift scans your project, shows the exact location of each finding, and suggests a safer approach. It reads your files without starting or executing your Laravel application.

The first release checks Blade templates for unsafe, unescaped output. More Laravel security checks will be added in future releases.

Install

Install LaraSift as a development dependency in your Laravel project:

composer require --dev samigitz/larasift

Run a scan

From your Laravel project, scan the current directory:

./vendor/bin/larasift

Show the reason for each finding and the suggested fix:

./vendor/bin/larasift --details

Choose what to scan

Run one category:

./vendor/bin/larasift --category=xss

Run one rule:

./vendor/bin/larasift --rule=LSEC-XSS-002

Only show findings at or above a severity level:

./vendor/bin/larasift --severity=high

JSON output

Use JSON in CI or other tools:

./vendor/bin/larasift --format=json

List the available rules

./vendor/bin/larasift list-rules

Exit codes

• 0: the scan completed with no matching findings
• 1: the scan found one or more matching issues
• 2: the command or an option was invalid
• 3: the scan could not finish correctly

Current security check

LSEC-XSS-002 finds dynamic Blade output that uses {!! !!} without HTML escaping. It ignores escaped output, Blade comments, @verbatim blocks, and static text.

LaraSift reports potential security problems. A clean scan does not guarantee that an application is secure, and every finding should be reviewed in context.

Requirements

• PHP 8.2 or later
• A Laravel application

Security

Please do not report security vulnerabilities through public GitHub issues. Follow the private reporting instructions in SECURITY.md.

Development

Run the project checks:

composer check

Licence

LaraSift is open-source software released under the MIT licence.