Does ShieldCI send my code to a server?

No. All analysis runs locally on your machine or CI server. Only metadata (score, issue counts, file paths) is sent to the dashboard - never your actual source code.

What Laravel versions are supported?

ShieldCI supports Laravel 9 and above with PHP 8.1 or higher. We actively test against all supported Laravel versions with each release.

How do I integrate with CI/CD?

ShieldCI works with any CI system. We provide ready-to-use examples for GitHub Actions and GitLab CI. Simply add the composer package to your project and run "php artisan shield:analyze --ci --report" in your pipeline. Read the CI/CD integration guide →

What's the difference between free and paid?

The free open-source package includes 73 analyzers covering essential security, performance, reliability, code quality and best practice checks. Paid plans unlock 82 additional pro analyzers (155 total), plus the cloud dashboard with historical reports, team collaboration, GitHub App and GitLab integrations, and REST API access.

Can I customize which analyzers run?

Yes. Publish the config file with "php artisan vendor:publish --tag=shieldci-config" and enable/disable specific analyzers. You can also configure severity thresholds and exclusion patterns.

Is there a free version?

Yes! Start with our free open-source package to experience ShieldCI. When you are ready for more analyzers and the cloud dashboard, upgrade to a paid plan with a 14-day money-back guarantee.

155 analyzers · 7 ticket providers · Laravel 9+

Automated Code Analysis For Laravel Applications Covering Security

155 purpose-built analyzers covering security, performance, reliability, best practices, and code quality, with a full lifecycle to assign, ticket, and verify every finding.

Get Started

View Documentation

or install the free package

1 · Detect locally or in CI

2 · Track in dashboard

checkout-api · production

improving

+4 this week

N+1 query in PostsController@indexassigned · jane

Mass assignment in UserControllerverified · 2h ago

Slow query in CartServiceJIRA-2305

The full loop

Five steps from commit to verified fix

Detection is where most tools stop. ShieldCI follows the issue through assignment, ticketing, resolution, and verification: the whole loop, in one platform.

Detect
Catch the issue before it ships
155 analyzers across security, performance, reliability, code quality, and best practices. Per-environment scoring ensures development/local noise never drags prod/staging down.
Step 1 of 5
php artisan shield:analyze
Report Card
==========
Category Pass Fail N/A
Security 58 4 2
Performance 27 4 2
Reliability 24 3 1
Code Quality 6 2 0
Best Practices 19 3 1
● 2 Eloquent N+1 query issues in PostsController@index
Assign
Route the fix to the right person
Assignment lifecycle (open → in-progress → resolved → verified) with overdue indicators, my-assignments view, and auto-sync on re-analysis. Nobody loses track, nothing falls through.
Step 2 of 5
JD
Assigned to Jane Doe
Due in 2 days · Performance
in progress
lifecycle
Open
In progress
Resolved
Verified
Ticket
Ship to the tracker you already use
Seven providers: Jira, Linear, GitHub Issues, Asana, GitLab Issues, ClickUp, and a generic webhook. Set a primary tracker per project; ShieldCI keeps the local assignment in sync.
Step 3 of 5
JiraSHLD-421
In Review
LinearENG-88
Todo
GitHub#1204
Open
Resolve
Fix it, close it, move on
Comment threads on every issue with a full timeline: occurrences, assignments, suppressions, and ticket links. Everything the next engineer needs, in one place.
Step 4 of 5
resolved in a3f2e9c · 4h ago
jane: “Switched to with('author') to eager-load.”
linked to Jira SHLD-421
Verify
Prove the fix holds
Re-analysis auto-verifies: resolved issues that disappear on the next run mark as verified. Scores climb, sparklines trend up, shareable reports go out to clients with a password-gated link.
Step 5 of 5
94%
+7 this week
14-day trendverified · shared

Category	Pass	Fail	N/A
Security	58	4	2
Performance	27	4	2
Reliability	24	3	1
Code Quality	6	2	0
Best Practices	19	3	1

Comprehensive coverage

155 analyzers across 5 categories

73 free in the open-source package, 82 pro analyzers for the cloud dashboard. Every analyzer is Laravel-aware, understanding framework conventions and idioms.

Security

XSS, SQL injection, CSRF, authentication, and authorization vulnerabilities.

Performance

N+1 queries, missing indexes, caching opportunities, and optimization hints.

Best Practices

Laravel conventions, design patterns, and idiomatic framework usage.

Code Quality

Naming conventions, code organization, and structural consistency.

Reliability

Error handling, logging standards, and deployment readiness checks.

Platform-Aware Analysis

Running on Vapor or Lambda? Recommendations adapt to your environment automatically. No false alarms.

Compliance Built-In

GDPR, SOC2, HIPAA, and PCI-DSS analyzers scan your app against real compliance requirements.

Dev Tools Stay Local

Telescope, Debugbar, Ray, and Xdebug are checked every scan; development tools should never reach production.

Laravel security

Catch vulnerabilities before they ship

ShieldCI's security analyzers are built by security experts who understand Laravel inside and out. Detect OWASP Top 10 vulnerabilities specific to Laravel applications.

01/10

XSS Detection

Identifies unescaped output in Blade templates and potential cross-site scripting vulnerabilities.

Start Securing Your App

Live severity breakdown

sample report

Critical

23%

High

810%

Medium

1418%

Low

3140%

Info

2229%

See it in action

Your dashboard, live.

Real charts, real data shapes, real updates. This isn't a screenshot. It's the same components that render your actual project health.

Score trend

Score 94%

+12 · After security sprint

Severity mix

Initial scan

Distribution of open issues

Critical

34%

High

912%

Medium

1621%

Low

2836%

Info

2127%

Category health

Initial scan

Pass-rate by analyzer category

Close the loop

Ship fixes through the tools you already use

ShieldCI writes to seven trackers out of the box. Set a primary tracker per project and every finding routes to the right place, with a two-way sync that flips issues back to resolved when the ticket closes.

Jira

Linear

GitHub Issues

Asana

GitLab Issues

ClickUp

Generic Webhook

Need another tracker? The generic webhook provider ships any finding to any HTTP endpoint with a configurable JSON shape.

Seamless CI/CD integration

Fits your pipeline. Shareable reports.

One YAML step wires ShieldCI into your existing CI/CD pipeline. Send clients a password-gated report link. No account required to view.

CI/CD pipeline

- name: Run ShieldCI
  uses: shieldci/action@v2
  with:
    api_token: ${{ secrets.SHIELD_TOKEN }}
    fail_on: high

One step in your existing pipeline. ShieldCI blocks merges that introduce security issues, with no infrastructure to manage.

Public report sharing

Copy

Password-gatedExpires in 90 days

Tokenized links, optional password, expiry date, and view counting: purpose-built for agencies reporting back to clients.

Pricing

Pricing that scales with your team

Every plan includes the shieldci/laravel-pro package: 82 pro analyzers on top of the 73 free open-source ones.

Looking for a free option? Try our open-source package with 73 analyzers, no account required.

Solo Dev

For individual developers

$0/per month

3 projects
82 pro analyzers
30-day report history
REST API access
Environment-aware scoring
Email support

Get started

Business

Enterprise

For large organizations