Free Laravel Vulnerability Scanner
An external Laravel security scanner that checks your live app the way an attacker would. 30+ Laravel-specific vulnerability checks, no package to install and no server access needed.
Scanning your application...
This usually takes 10-20 seconds. We're checking for common security issues.
What We Scan For
Laravel-specific checks that generic scanners miss.
Exposed .env File
CriticalChecks if your .env file is publicly accessible, leaking database credentials, APP_KEY, and API secrets.
Debug Mode in Production
CriticalDetects APP_DEBUG=true which exposes stack traces, environment variables, and database details to anyone.
Telescope & Ignition Exposure
CriticalFinds publicly accessible Telescope dashboards and Ignition debug pages that reveal application internals.
Security Headers
HighAnalyzes HSTS, CSP, X-Frame-Options, and other headers that protect against XSS, clickjacking, and MIME attacks.
Session Cookie Security
HighChecks Secure, HttpOnly, and SameSite flags on session cookies to prevent hijacking and CSRF.
CORS Configuration
HighDetects wildcard origins with credentials enabled, which lets any website call your API as the logged-in user.
SSL/TLS Configuration
HighValidates certificate validity, protocol versions, and cipher suites against current best practices.
Directory Listing
MediumChecks if directory listing is enabled, exposing your file structure to reconnaissance.
Subdomain Takeover
HighIdentifies dangling DNS records pointing to deprovisioned services that attackers can claim.
Plus 20+ more checks including CSRF protection, XSS vectors, JWT security, rate limiting, email security, and DNS configuration.
How the Laravel Vulnerability Scan Works
Four stages, roughly 60 seconds, entirely read-only.
Fingerprint the stack
The scanner confirms the application is Laravel and infers the major version from response headers, cookie naming, session driver behaviour, and error page structure. This matters because Laravel changes its secure defaults between versions, so the same configuration can be safe on one release and risky on another.
Probe the known Laravel surface
Laravel applications share a predictable file and route layout. The scanner requests the paths that matter, including .env, .git/config, storage and vendor directories, Telescope, Horizon, and the Ignition solution endpoints, and records exactly what came back rather than guessing from the status code alone.
Analyse what the responses reveal
Most real findings come from response detail rather than a single exposed file. Session cookie flags reveal config/session.php settings. Stack traces reveal whether APP_DEBUG is live and often leak environment values. Header combinations reveal missing CSP, HSTS, and frame protection. CORS preflight responses reveal whether any origin can call your API with credentials.
Grade and map to fixes
Every finding is scored by severity and mapped to a Laravel-specific fix guide with the exact config key, Artisan command, or server directive that resolves it. You get an A to F grade for the application overall, so a regression after a deploy is immediately visible.
Why a Laravel-Specific Scanner?
Generic scanners miss Laravel risks
Tools like OWASP ZAP, Nuclei, and Nessus scan for broad web vulnerabilities. They don't know about config/session.php, Telescope, Ignition, Horizon, or Laravel's specific file structure. StackShield does.
No code installation required
StackShield scans from the outside, like an attacker would. No Composer packages, no agents, no server access needed. Enter your URL and get results in minutes.
Actionable fix guides
Every issue comes with a Laravel-specific fix guide showing exact config changes, Artisan commands, and server configurations needed to resolve it.
Continuous monitoring
One-off scans catch today's issues. StackShield monitors continuously with scheduled scans, CI/CD integration, and real-time alerts via Slack, email, or webhooks.
What an External Scan Can and Cannot See
No single tool covers Laravel security completely. Here is the honest boundary, so you know what still needs attention elsewhere.
Visible from outside
- Exposed .env, .git, and backup files being served
- Debug mode live in production, including leaked environment values in stack traces
- Telescope, Horizon, and Ignition endpoints reachable without authentication
- Session cookie flags, which reflect your config/session.php
- Security headers as actually emitted, not as configured
- CORS policy, SSL and TLS posture, directory listing, subdomain takeover risk
Not visible from outside
- Known CVEs in your Composer dependencies, which need your lock file
- SQL injection in a query builder call that is never reached by an unauthenticated request
- Authorisation gaps behind a login, such as a missing policy check on an owned resource
- Mass assignment risk from an unguarded model
- Secrets committed to your repository history
Pair the external scan with a dependency audit
The right companion for the right column is composer audit, which ships with Composer 2.4 and above and checks your lock file against the PHP Security Advisories database. It costs nothing and takes seconds. Run it in CI alongside a scheduled external scan and you cover both the packages you depend on and the posture you actually deployed.
Stay Updated on Laravel Security
Get actionable security tips, vulnerability alerts, and best practices for Laravel apps.
Frequently Asked Questions
What does the Laravel vulnerability scanner check?
It runs 30+ external checks specific to Laravel: exposed .env files, debug mode, Telescope, Ignition and Horizon exposure, security headers, session cookie flags, CORS config, SSL/TLS, directory listing, subdomain takeover, rate limiting, and more.
Do I need to install a package?
No. The scanner works externally by sending HTTP requests to your application, the same way an attacker would. No Composer packages, agents, or server access required.
How is this different from Nuclei or OWASP ZAP?
Generic scanners check for broad web vulnerabilities but miss Laravel-specific attack surfaces. StackShield knows Laravel conventions: it checks config/session.php settings via cookie analysis, detects Telescope and Ignition endpoints, identifies APP_KEY exposure patterns, and more.
Is there a Laravel security scanner I can run myself?
For dependency vulnerabilities, composer audit ships with Composer 2.4 and up and reads your lock file against the PHP advisory database. It is the right tool for known CVEs in packages you depend on. It cannot see runtime posture, which is what an external scan covers: whether debug mode is live, whether Telescope is reachable, or whether your .env is being served. The two views answer different questions and neither replaces the other.
Which Laravel versions are supported?
All of them. Because the scan is external it does not depend on your Laravel version, PHP version, or how the app is deployed. Checks that target version-specific behaviour, such as Laravel 13 session and cookie defaults, are applied based on what the application actually returns rather than a declared version.
Will scanning slow down or damage my site?
No. The scan is read-only and non-intrusive. It sends a small number of ordinary HTTP requests, does not attempt exploitation, does not submit forms, and does not brute force anything. It behaves like a careful visitor, not a penetration test.
Can I scan a staging or password-protected site?
The scanner needs to reach the URL to assess it, so a site behind HTTP auth or an IP allowlist will return limited results. Staging environments that are publicly reachable scan normally, and are worth scanning, since debug mode and exposed .env files are more common there than in production.
Is the free scan limited?
The free scan runs a subset of checks and gives you an overall grade. Paid plans unlock all 30+ checks, scheduled monitoring, CI/CD integration, team collaboration, and alerts.
Can I integrate this into CI/CD?
Yes. Paid plans include hash-authenticated endpoints for GitHub Actions, GitLab CI, Bitbucket Pipelines, and Laravel Envoyer. Fail your build if critical security issues are detected after deployment.
How often should I scan?
After every deployment at minimum. Configuration regressions, such as debug mode re-enabled or .env exposed after a server change, are the most common cause of Laravel security incidents. StackShield supports hourly, daily, weekly, and monthly scan schedules.
Secure Your Laravel App Today
Run your first scan in under a minute. No credit card, no code changes, no setup.
14-day free trial on all plans.