Auditing a Laravel App's Security in One Command (No Terminal Required)

Most security tools ask a lot of you before they tell you anything: create a cloud account, wire up CI, install a scanner and its dependencies, maybe send your code to a server. Sometimes you just want an honest snapshot of where a Laravel app stands — locally, right now, before a launch or a client handover.

That's the gap Observer fills. It's a single offline binary (free and MIT) that scans a codebase for security and production-health issues and writes one self-contained HTML report — no account, no telemetry, nothing installed on your system. Point it at a project, open the report. This post walks through auditing a Laravel app with it end to end.

Install

Grab the binary for your OS from the releases page, or use a package manager:

# macOS / Linux
brew install https://raw.githubusercontent.com/sanks205/getobserver/main/packaging/homebrew/observer.rb

# Windows
scoop install https://raw.githubusercontent.com/sanks205/getobserver/main/packaging/scoop/observer.json

# Go
go install github.com/sanks205/getobserver/cmd/cli@latest

There's no runtime to set up — it's one statically-linked file.

The one command

From the root of your Laravel project:

observer analyze . --out report.html

That's the whole audit. Observer detects the stack (Laravel, the PHP version, your database), scans the code, inspects your config and dependencies, scores the project, and writes report.html. Open it in a browser — or print it to PDF to hand to a client.

Reading the report

The report leads with a Security Rating (A–E) — the same worst-severity-present model tools like SonarQube use, grounded in CVSS/CWE/OWASP — alongside 0–100 Security and Code Health scores. Below that, a "Fix These First" list surfaces the highest-impact issues, and findings are grouped by rule so a large app collapses into a few dozen scannable groups instead of an endless wall. Every finding carries a severity, a file/line, and a before → after fix you can act on immediately.

What it flags on a Laravel app

Out of the box, the free core catches the things that most often bite Laravel apps in production:

• Secrets and config — Observer inspects your .env and config files for committed secrets, APP_DEBUG=true shipped to production, and hardcoded API keys in code.
• Injection-prone queries — raw SQL built with string concatenation (DB::select("... " . $id)) instead of bindings.
• Dependency CVEs — add --cve and it checks your composer.json against OSV.dev for known-vulnerable packages.
• Infrastructure & config — Dockerfiles, docker-compose, Kubernetes manifests, and nginx/Apache configs for misconfigurations (running as root, :latest, exposed DB ports, obsolete TLS).

For deeper, framework-aware rules — unescaped Blade ({!! !!}), mass-assignment, APP_KEY handling, Eloquent raw expressions, and packs for CodeIgniter, WordPress, Symfony, Django, Rails and Spring — there's an optional one-time Observer Pro add-on. The free core stands on its own for a solid audit; Pro layers Laravel-specific depth on top.

No command line? Double-click it

The latest release (v0.4.0) added a zero-CLI path for teammates who don't live in a terminal: double-click the binary and Observer opens a local dashboard in your browser. Paste a folder, click Scan, and read the report — past scans, stack, and "new since last scan" all live on one page. Same engine, no typing.

In CI

The same binary drops into a pipeline. Fail the build on new high-severity issues and emit SARIF for GitHub code scanning:

observer analyze . --sarif observer.sarif --fail-on High

Adopting it on an existing app? Record a baseline first, then report only new issues so you're not drowning in pre-existing debt:

observer analyze . --write-baseline .observer-baseline.json
observer analyze . --baseline .observer-baseline.json --fail-on Medium

Offline and auditable

By default nothing leaves your machine — no account, no phone-home. For regulated or client-confidential work you can make that guarantee enforceable:

observer analyze . --assert-offline

It refuses to run if any network-requiring flag was passed and prints Offline mode: no network I/O. so you can evidence it in an audit — useful for finance, healthcare, or reviewing a client's code under NDA.

Wrap-up

Observer won't replace a continuous platform like SonarQube or an always-on monitor like Sentry — it's a different shape of tool: a fast, offline, one-command snapshot that unifies code, dependencies, config and infra into a single report you can read or share. For a pre-launch check, a legacy handover, or just seeing where a Laravel app really stands, it's about as low-friction as a security audit gets.

The core is free and MIT — try it on your current project and see what the report says: github.com/sanks205/getobserver.