Project Secure

This package installs a Composer plugin that reports unwanted changes to your Laravel project code after installing or updating a third-party library.

Rationale

A secure Laravel app implements multiple methods of protection and overlapping defensive strategies. This Composer plugin makes a fingerprint of your Laravel application code before a package is installed or updated. At the end of the process, it compares the code to the first fingerprint. If anything is changed, added or removed, it will alert you with an error in the context of the Composer action.

Why would I need this - I already have git? You should be using version control, and I'm happy to hear it. This package is meant to be defense in depth. Everyone always reviews their code line by line before they commit it - right? Right?? If you're like me, and you find sometimes you don't and just commit a whole swath of code, then this is for you. It's also for you if you're not using version control and running a Composer install/update.

Oh and one more thing - this project is just starting with watching your app directory for changes. Future features may include watching for changes to folders outside of the vendor-specific directories that are listed as dependencies of the package - or even scanning of auto-registered service providers. Stay tuned!

Prerequisites / Requirements

• Composer 2
• Laravel 5.8+

Installation

Install this with Composer:

composer require laravelhacker/project-secure

Usage

If your app code is found in the app folder as a sibling of the Composer vendor folder, it will be scanned and watched during composer install and composer update calls automatically. If nothing was found, it will be silent. If it finds a file change, a file addition or a file deletion, it will alert you with an error output using the Composer process.

Currently there are no implementation steps or configuration options.

Features / Bugs

You can create a feature request or a bug report using the project issues functionality. There are templates available.

Contributing

Contributions are welcome via pull request. See CONTRIBUTING.md for more.

Security

For security issues, please email aaron at the laravelhacker.com domain instead of using the issues tracker.

License

MIT. See LICENSE for more information.