Framework Posture & Secret Leak Detection

Security checks for PHP & Laravel

Purpose-built verification for Laravel and modern PHP applications: exposed environment secrets, debug-mode leakage, session flags, and framework misconfigurations — via non-destructive, read-only probes.

radar Scan Your Laravel Application

check_circle Safe handshakes — zero-write GET/HEAD requests check_circle Evidence redacted before persistence check_circle Plain-English Nginx & Apache fixes

No credit card or agent installation required for perimeter checks.

Detection Catalog

Critical PHP & Laravel exposures addressed

Automated, surgical checks mirroring attacker reconnaissance against your public web root.

Critical Severity

Exposed .env configuration files

Accidental public exposure of dotfiles allows direct download of master credentials: APP_KEY, database passwords, cloud secret keys, and SMTP tokens via a plain HTTP GET.

GET /.env  →  200 OK (text/plain)
<-- this should never happen

High Severity

Active production debug mode (APP_DEBUG=true)

Unhandled errors on a debug-enabled site render detailed Ignition or Whoops stack traces — database queries, server file paths, and environment variables dumped to any visitor.

GET /non-existent-route
→ full stack trace (misconfiguration)

Medium Severity

Insecure session & cookie flags

Laravel session and XSRF tokens should mandate strict browser isolation. We audit live responses to verify the Secure, HttpOnly, and SameSite attributes on your cookies.

Set-Cookie: laravel_session=…
[missing: Secure; SameSite=Lax]

High Severity

Exposed git repositories & build artifacts

Detection of an exposed /.git/HEAD, composer.lock, or deploy configuration files sitting in a mis-mapped web root.

GET /.git/config  →  200 OK
(origin exposed)

Redaction Pipeline

Evidence redaction & developer safety

We understand the sensitive nature of framework audits. When our checks touch material with secrets, the evidence is sanitized before it is stored — server-side, at ingestion time.

Received over the wire — never persisted raw

APP_NAME=LaravelProd
APP_KEY=base64:7Gfj281nNm92k0…
DB_CONNECTION=mysql
DB_PASSWORD=SuperSecretProduction!99
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI…

Illustration only — raw buffer content is never stored.

Stored report evidence — sanitized

APP_NAME=LaravelProd
APP_KEY=[REDACTED]
DB_CONNECTION=mysql
DB_PASSWORD=[REDACTED]
AWS_SECRET_ACCESS_KEY=[REDACTED]

Redaction happens in the ingestion pipeline before the report hits storage — not in your browser.

check

Zero-impact, non-destructive probes: rate-limited HTTP GET and HEAD requests exclusively. We never submit POST payloads, test SQL injections, or exhaust your worker threads.

verified_user

Verified ownership requirements: recurring checks require a DNS TXT or HTTPS well-known challenge token to guarantee you own or administer the target server.

Engineer Runbook

Copy-paste remediation for Nginx & Apache

Eliminate the most common accidental Laravel web-root exposures with standard production hardening.

/etc/nginx/sites-available/default

# Block all hidden dotfiles (.env, .git, backups)
# except ACME certificate HTTP challenges
location ~ /\.(?!well-known).* {
    deny all;
    access_log off;
    log_not_found off;
}

public/.htaccess (Apache)

# Emit a clean 404 instead of 403 to avoid
# advertising that the files exist
RedirectMatch 404 /\.env
RedirectMatch 404 /\.git
RedirectMatch 404 /composer\.(json|lock)

Standard Laravel production deployment checklist

done 01. Validate environment: ensure APP_ENV=production and APP_DEBUG=false in your live .env.
done 02. Cache configuration: run php artisan config:cache (and route:cache) to prevent runtime env parsing errors.
done 03. Verify the web root: your Nginx/Apache document root must point strictly to /var/www/site/public — never the project parent containing app/ or vendor/.

Audit Boundaries

External perimeter vs. deeper analysis

Understand exactly what we verify from the public internet versus what requires repo or host access.

travel_explore External perimeter probing — zero credentials needed

check_circle Public dotfile probing: verifies inaccessible status of /.env, /.git, and similar sensitive paths.
check_circle Stack-trace leakage: synthetic erroneous requests verify debug screens are suppressed.
check_circle Transport security: session cookie flags and security response headers.

code Repo & host analysis — requires repo/CLI access

check_circle Composer dependency audit: your composer.lock is parsed and inventoried, with vulnerable packages flagged for advisory confirmation.
check_circle Local permission auditing: via the read-only host agent, checking storage and cache directory permissions on your server.
check_circle Pipeline integration: repository analysis fits CI workflows for pre-deploy checks.

Knowledge Base

Laravel security FAQ

Why do .env files frequently leak on Nginx servers running Laravel?

Nginx requires explicit rules in its central server block to deny hidden files. If the document root is pointed at the repository parent (e.g. /var/www/my-app) instead of /var/www/my-app/public, or the deny block is missing, Nginx serves the plain-text .env directly over HTTP 200.

How can an exposed APP_KEY be abused?

Your APP_KEY encrypts sessions and other sensitive payloads. With the key in hand, an attacker may decrypt captured session cookies and forge trusted payload values. Rotate the key immediately and invalidate all sessions.

Is APP_DEBUG=true dangerous outside production?

Debug mode should be enabled only in local development. On any internet-reachable environment — staging included — it leaks stack traces, environment values, and file paths to anonymous visitors.

Does CheckWebSecurity store the passwords it finds in exposed files?

No. Exposed-file checks record the accessibility status of the path. Where evidence snippets are collected, they are redacted at ingestion time before storage — secrets and high-entropy values are masked server-side.

Check your Laravel application

Start 7-Day Free Trial