Most security tools ask a lot of you before they tell you anything: create a cloud account, wire up CI, install a scanner and its dependencies, maybe send your code to a server. Sometimes you just want an honest snapshot of where a Laravel app stands — locally, right now, before a launch or a client handover.
TL;DR — Observer is a free, MIT, single-binary tool that audits a Laravel app for security & production-health issues — offline, no account. Point it at your project (or just double-click it) and get one HTML report. ⬇️ Download it →
That's the gap Observer fills. It's a single offline binary (free and MIT) that scans a codebase for security and production-health issues and writes one self-contained HTML report — no account, no telemetry, nothing installed on your system. Point it at a project, open the report. This post walks through auditing a Laravel app with it end to end.
Install
No runtime, no dependencies, no account.
Easiest — download & double-click. Grab the binary for your OS from the releases page and double-click it: Observer opens a dashboard in your browser, you paste a folder, hit Scan, done. No command line.
Prefer the terminal?
# macOS / Linux
brew install https://raw.githubusercontent.com/sanks205/getobserver/main/packaging/homebrew/observer.rb
# Windows
scoop install https://raw.githubusercontent.com/sanks205/getobserver/main/packaging/scoop/observer.json
# Go
go install github.com/sanks205/getobserver/cmd/cli@latest
## The one command
From the root of your Laravel project:
bash
observer analyze . --out report.html
That's the whole audit. Observer detects the stack (Laravel, the PHP version, your database), scans the code, inspects your config and dependencies, scores the project, and writes `report.html`. Open it in a browser — or print it to PDF to hand to a client.
## Reading the report
The report leads with a **Security Rating (A–E)** — the same worst-severity-present model tools like SonarQube use, grounded in CVSS/CWE/OWASP — alongside 0–100 Security and Code Health scores. Below that, a **"Fix These First"** list surfaces the highest-impact issues, and findings are **grouped by rule** so a large app collapses into a few dozen scannable groups instead of an endless wall. Every finding carries a severity, a file/line, and a **before → after fix** you can act on immediately.
## What it flags on a Laravel app
Out of the box, the free core catches the things that most often bite Laravel apps in production:
- **Secrets and config** — Observer inspects your `.env` and config files for committed secrets, `APP_DEBUG=true` shipped to production, and hardcoded API keys in code.
- **Injection-prone queries** — raw SQL built with string concatenation (`DB::select("... " . $id)`) instead of bindings.
- **Dependency CVEs** — add `--cve` and it checks your `composer.json` against [OSV.dev](https://osv.dev) for known-vulnerable packages.
- **Infrastructure & config** — Dockerfiles, `docker-compose`, Kubernetes manifests, and nginx/Apache configs for misconfigurations (running as root, `:latest`, exposed DB ports, obsolete TLS).
For deeper, framework-aware rules — unescaped Blade (`{!! !!}`), mass-assignment, `APP_KEY` handling, Eloquent raw expressions, and packs for CodeIgniter, WordPress, Symfony, Django, Rails and Spring — there's an optional one-time [Observer Pro](https://observerly1.gumroad.com) add-on. The free core stands on its own for a solid audit; Pro layers Laravel-specific depth on top.
## No command line? Double-click it
The latest release (v0.4.0) added a zero-CLI path for teammates who don't live in a terminal: **double-click the binary** and Observer opens a local dashboard in your browser. Paste a folder, click **Scan**, and read the report — past scans, stack, and "new since last scan" all live on one page. Same engine, no typing.
## In CI
The same binary drops into a pipeline. Fail the build on new high-severity issues and emit SARIF for GitHub code scanning:
bash
observer analyze . --sarif observer.sarif --fail-on High
Adopting it on an existing app? Record a baseline first, then report only *new* issues so you're not drowning in pre-existing debt:
bash
observer analyze . --write-baseline .observer-baseline.json
observer analyze . --baseline .observer-baseline.json --fail-on Medium
## Offline and auditable
By default nothing leaves your machine — no account, no phone-home. For regulated or client-confidential work you can make that guarantee enforceable:
bash
observer analyze . --assert-offline
It refuses to run if any network-requiring flag was passed and prints `Offline mode: no network I/O.` so you can evidence it in an audit — useful for finance, healthcare, or reviewing a client's code under NDA.
## Wrap-up
Observer won't replace a continuous platform like SonarQube or an always-on monitor like Sentry — it's a different shape of tool: a fast, offline, one-command snapshot that unifies code, dependencies, config and infra into a single report you can read or share. For a pre-launch check, a legacy handover, or just seeing where a Laravel app really stands, it's about as low-friction as a security audit gets.
The core is free and MIT. Here's a 60-second challenge: **download it, double-click it, and scan your app** — then drop your **Security Rating (A–E)** in the comments. Most Laravel apps land on a C or D on the first scan. What does yours get?
👉 **[Download Observer](https://github.com/sanks205/getobserver/releases/latest)** — Windows / macOS / Linux, no install.
⭐ **[Star it on GitHub](https://github.com/sanks205/getobserver)** to grab it later when you need it.
If it catches something useful, a ⭐ on the repo genuinely helps other devs find it — and I'd love to hear what it flags on your project, good or bad, in the comments.
Top comments (1)
Quick one if you try it: run it on your app and drop your Security Rating (A–E) below 👇 — genuinely curious what people get on a first scan. Happy to help make sense of anything it flags.