Analyze a PHP web application or codebase for security vulnerabilities and OWASP compliance. Use when the user asks to audit, check, review, or analyze the security, vulnerabilities, OWASP compliance, or hardening of a PHP, Laravel, Kirby, Livewire, or Blade application. Also use when the user mentions "securite", "security", "OWASP", "injection SQL", "XSS", "CSRF", "faille", "vulnerabilite", "pentest", "hardening", "authentication", or "authorization". Specialized for PHP, Laravel, Kirby CMS, Livewire, Blade, Vite, Tailwind CSS, and SQL databases.
Audit a PHP web application's security from the codebase, based on the OWASP Top 10 (2021) and PHP/Laravel-specific security best practices. Focuses on what is verifiable in code.
Before auditing, understand the project:
.env handling and configurationcomposer.json)Read references/checklist.md in this skill's directory for the full list of practices to check.
For each category in the checklist, search the codebase for relevant patterns. Use Grep, Glob, and Read tools to find:
DB::raw, whereRaw, string concatenation in queries){!! !!} vs {{ }})$fillable or $guarded)unserialize() on user input)eval, exec, system, shell_exec, passthru).env file exposure risksProduce a structured report with these sections:
## Audit Securite PHP - [Project Name]
### Score global
X / Y pratiques conformes (Z%)
### Resume
[2-3 sentences summarizing the main findings]
### Resultats par categorie
#### [Category Name] (OWASP AXX)
| # | Pratique | Statut | Commentaire |
|---|----------|--------|-------------|
| 1 | ... | OK/KO/NA | ... |
### Vulnerabilites critiques
[List any findings that could be actively exploited]
### Top priorites
[5-10 most impactful fixes, ordered by risk/effort ratio]
### Recommandations detaillees
[For each KO finding, explain the vulnerability, exploitation scenario, fix, and relevant OWASP category]
Status values:
When listing recommendations, prioritize by exploitability:
Once the audit is complete, save the full analysis as a Markdown document at the root of the audited codebase:
/docs/YYMMDD_php-security-audit.md
Where YYMMDD is the current date (e.g., 260206 for February 6, 2026). Create the /docs/ directory if it does not exist.
The document must include:
### Plan d'action
#### Critique
- [ ] [Tache] — ~Xh (avec IA)
- [ ] [Sous-tache 1] — ~2h
- [ ] [Sous-tache 2] — ~3h
#### Haute priorite
...
#### Moyenne priorite
...
#### Basse priorite
...
**Total estime : ~Xh**