pieceofcake2 / security-sast

v1.0.4 2026-10-18 14:53 UTC

Requires

• php: >=8.0
• phpstan/phpstan: ^2.1
• pieceofcake2/report: ^1.0

Requires (Dev)

• cakephp/cakephp-codesniffer: ^5.0
• phpunit/phpunit: ^9.6

MIT

• security
• pdf
• cakephp
• report
• owasp
• cakephp2
• PHPStan
• SAST
• semgrep

Published on Packagist.org on 2026-10-18 14:54 UTC

README

Static application security testing of a CakePHP 2 application: its code is scanned with Semgrep (in Docker) or PHPStan and security rules for CakePHP 2 (SQL built from strings, redirects to values of the request, variables printed without h(), ...), and the findings are written as an A4 PDF report by rule and risk in the design of pieceofcake2/report, with an exit code that fails CI.

composer require --dev pieceofcake2/security-sast
vendor/bin/security-sast --pdf=tmp/security-sast.pdf --fail-on=high                  # Semgrep in Docker
vendor/bin/security-sast --engine=phpstan --pdf=tmp/security-sast.pdf --fail-on=high # PHPStan

Documentation

• Website: https://pieceofcake2.github.io/security-sast/ (日本語: https://pieceofcake2.github.io/security-sast/ja/)
• Markdown: docs/README.md (日本語: docs/ja/README.md) (for AI tools and offline reading)

Requirements

• PHP 8.0+
• Docker for Semgrep (PHPStan needs nothing else)
• Google Chrome or Chromium 131+

Installation

composer require --dev pieceofcake2/security-sast

Reporting Issues

Please open an issue on GitHub. To report a security vulnerability, use private vulnerability reporting.

Contributing

See the contribution guidelines.

Origin

This package was created by pieceofcake2, which also maintains it. It is not a fork of another project and is not based on one.

License

The MIT License. See LICENSE.