Free Laravel Security Scanner
One bad deploy can put your database credentials on the public internet, and nothing warns you.
Bots are already probing your Laravel app for a leaked .env, debug mode, or an exposed admin panel. Scan it now and see what they see.
Scanning your application...
This usually takes 10-20 seconds. We're checking for common security issues.
Frequently Asked Questions
Is the free security scanner safe to use?
Yes. Our scanner only performs passive, non-intrusive checks. It sends standard HTTP requests to publicly accessible URLs -- the same requests any visitor or search engine would make. It does not attempt to exploit vulnerabilities, inject payloads, or access anything that isn't already public.
What does the free scanner check?
The free scanner runs eight passive checks against your live site: debug mode enabled in production, an exposed .env file, Laravel Ignition debug endpoints, a publicly accessible Telescope dashboard, downloadable sensitive files (.git history, .env backups, Laravel logs), missing security headers, a dangerous CORS policy, and session cookie flags (Secure, HttpOnly, SameSite).
Why doesn't the free scanner run all 30 checks?
The free scanner only runs passive, non-intrusive checks, because you can point it at any URL. The rest of StackShield's 30+ checks include active scanning (port scans, SQL injection testing, brute-force and rate-limit probing) that should only run against apps you own, on a schedule, with monitoring. Start a free trial (no credit card) to run the full suite and keep it running after every deploy.
Do I need to sign up to use the free scanner?
No. The free scanner requires no account, no registration, and no credit card. Just enter your URL and get results instantly. If you want to catch issues that reappear after every deploy, you can start a free 14-day trial with no credit card required. It runs the full 30+ check suite and re-scans automatically after every deploy.
How often should I scan my Laravel application?
Security configurations can change with every deployment. We recommend scanning after each deploy and running continuous monitoring in between. StackShield's paid plans include automatic scheduled scans so you never miss a misconfiguration or newly introduced vulnerability.