README

Watch AI hack your Laravel app in 15 seconds.

Watch AI literally hack a vulnerable Laravel controller in front of your eyes — no setup, no API key.

composer require mahdisphp/laravel-hack-auditor
php artisan hack:demo

That's it. Two commands. Watch 12 vulnerabilities get ripped out of a controller in your terminal.

The commands

php artisan hack:demo                   # See it in action (no API key)
php artisan hack:scan                   # Scan YOUR app with AI
php artisan hack:scan --diff --html     # Scan only changed files, export HTML report
php artisan hack:ctf sql_injection      # Turn vulns into CTF challenges
php artisan hack:report --latest        # Generate HTML report from saved scan
php artisan hack:benchmark              # Measure accuracy (precision/recall/F1) on a labeled corpus
php artisan hack:help                   # Full command reference
php artisan hack:usage                  # Token usage & cost stats
php artisan mcp:start hack-auditor      # Expose the scanner to AI agents (Claude Code, Cursor)

hack:scan finds what PHPStan and Snyk can't:

• "This endpoint fetches a user by ID but never checks ownership" (IDOR)
• "Admin check reads is_admin from the request, not the session" (Auth bypass)
• "Login route has no throttle middleware" (Brute-forceable)
• "Any authenticated user can set their own plan to 'pro' without payment" (Auth bypass)

20 vulnerability types. OWASP Top 10 mapped, each with a CWE id. Every finding has file, line, explanation, and a copy-paste fix.

Deterministic detection engine — not just the AI

Alongside the AI pass, framework-aware detectors run on every scan and merge into the report, giving reproducible coverage that doesn't drift with AI run-to-run variance: IDOR / broken access control (policy-vs-route mismatch, is_admin in $fillable, unauthorized find()/findOrFail() exposure), SSRF (Http::get()/cURL with a user-controlled URL), and sensitive-data exposure (password/token/secret fields returned in a response). These are the OWASP-#1 access-control bugs generic SAST and generic AI both miss because they don't understand Laravel.

Measured accuracy — not a marketing claim

hack:benchmark runs the scanner against a labeled corpus and reports precision / recall / F1, usable as a CI gate (--min-f1). Measured on the bundled corpus: F1 ≈ 0.94, recall 1.00 (0 false negatives). The number is reproducible and ships in the repo — run it yourself.

Call it from your AI editor

mcp:start hack-auditor exposes the scanner as MCP tools (scan_path, scan_diff, explain_finding) so Claude Code, Cursor, and other agents can run a real taint-aware Laravel audit mid-edit instead of guessing.

Low false-positive rate

v1.5 introduces taint analysis — the AI must trace every input-dependent finding as SOURCE → TRANSFORMS → SINK before reporting it. The parser then programmatically verifies the trace: if the source is config() not $request->input(), auto-drop. If an (int) cast or $request->validated() breaks the chain, auto-drop. Zero extra API calls.

On top of that, v1.4's context-aware scanning reads your actual Laravel architecture — route middleware stacks, FormRequest authorize() methods, Eloquent $fillable/$hidden, policies, global scopes — and feeds it all to the AI before analysis. Framework-aware allowlists recognize $this->authorize(), Gate::define(), $request->validated(), and other Laravel conventions that eliminate entire classes of false positives.

Tested on production Laravel apps with 15-42 controllers and a deliberately vulnerable test app (100% true positive rate, 0 false positives).

Multi-pass verification (v1.6)

Pass --verify to have the AI attempt a concrete exploit for every HIGH or CRITICAL finding. Findings the model can exploit retain their severity and ship with a copy-paste exploit payload (exploit_proof). Findings it cannot exploit are downgraded one tier (Critical→High, High→Medium) with the original severity preserved in original_severity for audit trail — a placeholder or hedging response is treated as no-exploit.

php artisan hack:scan --verify
# → Verification 8/8 HIGH+ findings had working exploits (0 downgraded)
#   Verification tokens: 15,288 input + 1,702 output = 16,990 total

⚠️ --verify approximately doubles API cost on scans with many HIGH+ findings. Recommended for pre-release audits, not every CI run. Enable by default via HACK_AUDITOR_VERIFY=true.

Technical failures (AI timeouts, malformed responses) leave the finding untouched rather than downgrading on noise. The JSON output gains a verification sub-object with verified/downgraded counts and a separate token bucket so pass-1 and pass-2 cost are distinguishable.

Token usage & cost tracking

Every scan shows token consumption and estimated cost. Auto-detects your AI provider's pricing from a built-in registry of 30+ models (Anthropic, OpenAI, Gemini, xAI, Ollama). Budget your scans with --limit.

Token Usage ...... 97,188 prompt + 3,080 completion = 100,268 total
AI Requests ...... 7
Estimated Cost ... $0.5629
Model ............ claude-opus-4-6 (anthropic)

Quick setup (2 minutes)

php artisan install:ai                  # Install Laravel AI

Add one API key to .env:

ANTHROPIC_API_KEY=sk-ant-your-key-here  # or OPENAI_API_KEY, or GEMINI_API_KEY

Scan:

php artisan hack:scan

Done. The package uses whatever provider you configured in Laravel AI. Optionally override just for this package:

HACK_AUDITOR_AI_PROVIDER=anthropic
HACK_AUDITOR_AI_MODEL=claude-opus-4-6

Generate CTF challenges from real vulns

Train your team by turning actual findings into Capture The Flag exercises:

php artisan hack:ctf sql_injection    # By type
php artisan hack:ctf --from-scan      # From latest scan results
php artisan hack:ctf --all            # Generate for every finding

Each challenge outputs a ready-to-run directory: README, vulnerable code, solution, flag file, and docker-compose.

HTML reports, git-aware scanning, baselines

php artisan hack:scan --html            # Beautiful dark-themed HTML report
php artisan hack:scan --diff            # Only scan files changed in your branch
php artisan hack:scan --update-baseline # Accept current findings as known
php artisan hack:report --latest        # Regenerate report from saved scan

The HTML report is a single self-contained file — dark theme, animated score ring, collapsible cards, copy-paste code blocks, token usage breakdown. Professional enough to attach to a security audit.

--diff scans only what your PR touches. --update-baseline lets teams acknowledge known risks so CI doesn't fail on accepted findings.

Use it in code

use Mahdi\HackAuditor\Facades\HackAuditor;
use Mahdi\HackAuditor\Support\UsageTracker;

$report = HackAuditor::scan();

if ($report->hasCritical()) {
    // Block deployment, alert Slack, panic, etc.
}

echo $report->overallScore;                  // 0-100
echo $report->criticalCount();               // int
echo $report->getUsageTracker()?->totalTokens();  // tokens used
echo $report->getUsageTracker()?->estimateCost();  // estimated $$$

// Budget-capped scan
$tracker = new UsageTracker(tokenLimit: 50_000);
$report = HackAuditor::scan(tracker: $tracker);

// Scan history
$history = HackAuditor::history();
$latest = $history->latest();                // array or null
$all = $history->recent(10);                 // last 10 scans

# .github/workflows/security.yml
name: Security Audit
on: [push, pull_request]
jobs:
  hack-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: shivammathur/setup-php@v2
        with:
          php-version: '8.3'
      - run: composer install --no-interaction
      - run: php artisan hack:scan --json --severity=High --force
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

php artisan vendor:publish --tag=hack-auditor-config

Security

This package sends source code to AI providers. Files matching .env*, *.key, *.pem, and storage/logs/* are always excluded. Review your provider's data retention policies.

Found a vulnerability in this package? Email mahdi@mindzone.tech.

Contributing

PRs welcome. Run composer test and vendor/bin/pint before submitting.

License

MIT — LICENSE

If this saved you from getting hacked, star the repo.