rainbowriders / security-probe

v1.0.0 2026-11-03 16:52 UTC

Requires

• php: >=7.2.5
• illuminate/console: ^7.0|^8.0|^9.0|^10.0|^11.0|^12.0|^13.0
• illuminate/http: ^7.0|^8.0|^9.0|^10.0|^11.0|^12.0|^13.0
• illuminate/support: ^7.0|^8.0|^9.0|^10.0|^11.0|^12.0|^13.0

MIT

• Rainbow Riders

• security
• monitoring
• laravel

Published on Packagist.org on 2026-11-03 18:01 UTC

README

Reports a Laravel app's versions and security-relevant configuration to the Rainbow Riders security scanner once a day, so the scanner can check PHP, Laravel and database versions, APP_DEBUG/APP_ENV, session cookie settings and installed Composer packages for known vulnerabilities.

Sends no secrets. Only version numbers, config flags (true/false, environment name) and package names with versions. No .env values, no keys, no database data. See exactly what is sent with php artisan security:probe --dry-run.

Supports Laravel 7–13 on PHP 7.2.5+.

Install

composer require rainbowriders/security-probe

Add to .env (both values are on the solution page in the scanner):

SECURITY_PROBE_URL=https://security.rainbowriders.dk/api/probe
SECURITY_PROBE_TOKEN=...

Deploy as usual. If the config is cached, run php artisan config:cache after changing .env.

That is all: the package registers the security:probe command and schedules it daily between 03:00 and 04:59. It needs the project's normal scheduler cron (* * * * * php artisan schedule:run).

Check

php artisan security:probe --dry-run   # show the report, send nothing
php artisan security:probe             # send now; expect "Probe report sent."
php artisan schedule:list              # security:probe should be listed

Options

.env
SECURITY_PROBE_TIME	Fixed daily time instead of the automatic one, e.g. 05:30

Without SECURITY_PROBE_URL and SECURITY_PROBE_TOKEN the package does nothing.