README

The core Laravel security toolkit in the ArtisanPack UI ecosystem. Focused on input sanitization, output escaping, KSES filtering, security headers, XSS protection, basic rate limiting, and Content Security Policy.

Security 2.0 — core-only. Authentication, 2FA, RBAC, file uploads, analytics, and compliance have moved to dedicated sibling packages. See UPGRADE.md for migrating from 1.x.

What's in this package

• Sanitization — sanitizeEmail, sanitizeUrl, sanitizeText, sanitizeInt, sanitizeArray, …
• Escaping — escHtml, escAttr, escUrl, escJs, escCss (Laminas Escaper backed)
• KSES filtering — kses() WordPress-style allowed-tag filtering
• Validation rules — NoHtml, SecureUrl
• Middleware — csp, security.headers, xss.protection, api.security, api.rate_limit
• Content Security Policy — nonce generator, policy builder, presets, violation reporting endpoint, CSP dashboard Livewire component (optional — requires livewire/livewire), Artisan commands (csp:test, csp:stats, csp:prune, security:generate-csp)
• Security audit commands — security:audit, security:scan, security:baseline, security:benchmark, security:check-config, security:test-headers, security:scan-deps
• Testing infrastructure — OWASP scanner, configuration scanner, penetration testing helpers, performance benchmarks, report generators

What's NOT in this package (sibling packages)

Installation

composer require artisanpack-ui/security

Publish the config:

php artisan vendor:publish --tag=security-config

Quick Start

use ArtisanPackUI\Security\Facades\Security;

$cleanEmail = Security::sanitizeEmail($userEmail);
echo Security::escHtml($userContent);

Or use the global helpers:

$cleanEmail = sanitizeEmail($userEmail);
echo escHtml($userContent);

Middleware

Route::middleware(['csp', 'security.headers', 'xss.protection'])->group(function () {
    // ...
});

Route::middleware('api.rate_limit:api')->group(function () {
    // ...
});

CSP nonces in Blade

<script @csp_nonce>
    // ...
</script>

Documentation

• Getting Started
• API Reference
• Security Guidelines
• Upgrading from 1.x → 2.0
• Changelog

Requirements

• PHP 8.2+
• Laravel 10 / 11 / 12 / 13 (Laravel 13 requires PHP 8.3+)

Sibling packages

License

MIT — see LICENSE.