Return metadata for a Laravel project: composer constraints, framework detection, PHP version.

Audit Composer dependencies against the OSV.dev vulnerability advisory database. Parses composer.lock and reports CVEs with severity and fix versions.

Audit risky Laravel environment and configuration settings: APP_DEBUG, APP_ENV, APP_KEY, SESSION_SECURE_COOKIE, and CORS wildcard origins.

Run static pattern analysis across all PHP source files. Detects SQL injection, RCE risks (eval/shell_exec/exec/system), unsafe unserialize, hardcoded credentials, weak cryptography (MD5/SHA1), mass assignment, path traversal, and LFI risks.

Scan Laravel Blade templates in resources/views/ for XSS vulnerabilities. Detects unescaped output ({!! !!}), raw user input rendering, and unsafe PHP echo in templates.

Audit Laravel route files (routes/web.php, routes/api.php) for security misconfigurations. Detects admin routes without auth middleware, API routes without authentication, login routes without throttle, and CSRF exception wildcards in VerifyCsrfToken.

Run active HTTP security probes against a running Laravel application. Probes: error/debug disclosure, SQL injection on /login, reflected XSS, CSRF enforcement, auth bypass on /api/user, and brute-force rate limiting. WARNING: only use against local or staging environments — never production.

Run all static audits in parallel: dependency CVE check (OSV.dev), environment config, PHP code scan, Blade XSS scan, and route/middleware audit. Returns a single consolidated report with per-section summaries.