Changelog

Added

• •alerting-config counts an installed Laravel Nightwatch as alerting, unless config/nightwatch.php disables it (#396)

Changed

• •alerting-config credits monitoring packages only from composer.lock production dependencies, not require-dev (#396)
• •compression-headers verifies TLS certificates, so a self-signed staging certificate now warns (#397)
• •Requires shieldci/laravel ^1.18 (was ^1.15.1), for the shared origin probe compression-headers now uses (#397)

Fixed

• •eager-loading follows a model through foreach or a hand-off to a method or resource, rather than reporting its relations unused (#395)
• •eager-loading credits relations read inside the model's own methods and accessors (#395)
• •eager-loading reports a once for with(['a', 'a.b']), rather than twice (#395)
• •eager-loading no longer exhausts memory on $query = $query->where(...), which ended the whole run (#395)
• •compression-headers warns, naming the URL, when a probe fails, returns non-2xx or the wrong Content-Type, rather than passing (#397)
• •compression-headers follows same-host redirects and accepts text/javascript as JavaScript (#397)

Changed

• •audit-logging finds admin controllers by privileged route middleware such as can: or role:, rather than by directory name (#392)
• •audit-logging may name a different admin file than v1.5.0, so its dont_report entry can stop matching (#392)
• •arbitrary-file-upload no longer reports eval(), assert() or call_user_func(), leaving them to rce and eval-usage (#379)
• •Requires shieldci/analyzers-core ^2.8.1 (was ^2.8), so two imports on one alias no longer error Filament analyzers, middleware-misuse, octane-config or lazy-collection-opportunity (#391)

Fixed

• •arbitrary-file-upload reads rules only from validation sites, so a message or field named file or image is not a rule (#379, #384)
• •arbitrary-file-upload limits a FormRequest type hint to its own method rather than the whole file (#379)
• •arbitrary-file-upload judges each Filament FileUpload separately, so one constrained component no longer masks another (#379)
• •arbitrary-file-upload reports an original-filename storeAs() or move() line once, not twice (#379)
• •arbitrary-file-upload accepts Livewire's #[Rule] attribute alongside #[Validate] (#379)
• •octane-config skips its config checks when config/octane.php does not parse, rather than reporting keys as missing (#382)
• •octane-config and cdn-configuration name an unparsable config/octane.php or config/app.php in the report rather than losing it (#382)
• •dead-routes accepts every verb the router declares, so Route::any() is not flagged on Laravel 13.35 (#388)
• •audit-logging counts a write through a LogsActivity or observed model as logged (#386)
• •audit-logging reports Skipped, naming the file, when a controller or model it relies on does not parse (#386)
• •audit-logging reads listeners from every provider, models from app/Models subdirectories, and channels named like audit_trail (#392)
• •policy-authorization, audit-logging and filament-table-optimization resolve a relative name such as Models\Post as PHP does (#389)
• •filament-resource-authorization judges a resource whose base class is aliased, rather than skipping it (#389)
• •filament-tenancy names the first withoutGlobalScopes() file in path order, so baselines match between local and CI (#390)
• •lazy-collection-opportunity resolves an aliased model before ->pluck(), so an accessor gets no query-pluck advice (#391)

Added

• •filament-panel-security, filament-resource-authorization, filament-custom-pages, filament-widget-security and audit-logging report a Filament file whose syntax error stopped it parsing, one analyzer owning each kind (#377)

Changed

• •A panel provider's declared discoverResources(), discoverPages(), discoverWidgets() and discoverClusters() roots are read, so a file outside app/Filament is judged rather than invisible (#375)
• •The Filament analyzers report Skipped where discovery finds no files, rather than Passed, apart from filament-panel-security and audit-logging (#375)
• •filament-tenancy reports Skipped where no panel provider exists, apart from the Passed it keeps for panels configuring no tenancy (#375)
• •filament-tenancy's withoutGlobalScopes() finding can name a different file, now that a second panel's and a cluster's resources are searched, so regenerate the baseline once (#375)
• •audit-logging's unlogged-surface finding is reworded and names a file it read rather than a hardcoded path, so it rehashes; regenerate the baseline once (#376)
• •The Filament analyzers report Skipped where a file in their input could not be read, rather than Passed, so an unparsable file no longer passes (#377)
• •Requires shieldci/analyzers-core ^2.8 (was ^2.7), for a failed parse that is never cached, so a second run in one process records it again (#377)

Fixed

• •The Filament analyzers judge a resource, page or widget inside a cluster, which previously passed unopened (#375)
• •filament-form-validation, filament-navigation, filament-resource-authorization, filament-table-optimization and filament-tenancy judge a second panel's resources, which a hardcoded app/Filament/Resources missed (#375)
• •filament-widget-security finds a widget nested in a subdirectory below its root, which was skipped entirely (#375)
• •filament-widget-security recognises a widget extending an aliased base class, so its missing canView() is reported (#375)
• •filament-resource-authorization, filament-navigation and filament-tenancy judge a resource by what it extends, not a *Resource.php filename (#375)
• •filament-panel-security, filament-navigation and filament-tenancy find a panel provider at any depth under app/Providers (#375)
• •filament-panel-security reads app/Models recursively, so a FilamentUser model under app/Models/Auth/ no longer reports that none implements it (#375)
• •filament-table-optimization reads a custom page's table(), so an N+1 in a page built with InteractsWithTable is reported (#376)
• •filament-tenancy judges only the resources of panels declaring tenancy, so a non-tenant panel's are no longer flagged for missing scoping (#375)
• •filament-tenancy keeps the resources of a panel that shares a directory with another, rather than losing them to it (#375)
• •filament-tenancy no longer puts a panel through the tenancy audit for a ->tenant( in a string or heredoc, the check now reading the AST (#375)
• •audit-logging counts every Filament resource, page, widget and cluster as an admin surface, so logging in one is credited and its absence reported (#375, #376)
• •audit-logging requires an activity() call to reach ->log() across all six of its logging checks, so a widget or observer that only reads the log no longer declares a surface audited (#376)
• •audit-logging credits activity('security') and other named log channels, which the old activity() needle missed and reported as unlogged (#376)
• •filament-panel-security finds a panel provider whose file will not parse, reading the class out of the source rather than reporting that no panel is configured (#377)
• •filament-resource-authorization keeps a resource whose file will not parse, rather than dropping it to a support file and out of its input (#377)
• •audit-logging no longer reports an admin surface as unlogged when a file on it could not be read, rather than counting an unread file as evidence (#376, #377)

Added

• •filament-panel-security judges canAccessPanel() on every FilamentUser model, reporting an outright grant, an authentication-only check, or a body that ignores its Panel (#372)

Changed

• •filament-panel-security drops the per-panel authGuard finding, which flagged Filament's own generated configuration (#372)
• •Weak Filament gate findings name the defect, so they rehash; regenerate the baseline once (#372)
• •Requires shieldci/analyzers-core ^2.7 (was ^2.2), for the shared parser's recordRecovery() (#371)

Fixed

• •filament-panel-security reads ->authMiddleware() and ->path() from the call arguments, so a commented-out call no longer hides an unprotected panel (#372)
• •filament-panel-security, filament-navigation and filament-tenancy find a panel provider in app/Providers/ too, rather than skipping every check (#372)
• •The five Filament access-method checks credit a gate that denies through abort_unless() or throw_unless() before granting, rather than reading it as a blanket grant (#372)

Added

• •horizon-security, nova-security, pulse-security and telescope-security check the same five weak gates: authentication-only, a ?? true fallback, an environment bypass, a callback that ignores its parameters, and a denyIf() that can never fire (#366, #367)

Changed

• •Weak-gate findings are graded by the registration's reach rather than a flat High: the full grade unconditional, two lower inside local, one lower behind a wider guard (#367)
• •Gate findings name their guard and carry a line, so they rehash; regenerate the baseline once (#366, #367)

Fixed

• •The four gate analyzers judge the callback from the AST, so fn () => true, a first-class callable, [$class, 'method'] and 'Class@method' are read, where the old regex needed a literal return true; (#364, #366)
• •The gate is resolved from every provider plus bootstrap/app.php rather than one hardcoded file (#366)
• •nova-security stops reporting a sound gate as wide open, having fallen back to scanning the whole provider where an unrelated return true; matched (#366)
• •A permissive fallback counts only in the fallback position, and an environment check only where it can grant by itself (#367)

Changed

• •Every analyzer's severity badge matches the findings it emits; the exit code grades findings, so builds are unaffected (#341)
• •horizon-security, telescope-security, nova-security and pulse-security report a missing dashboard gate as Medium rather than Critical, an undefined gate denying access outside local (#346)
• •Stock-install states drop off Critical: four telescope-security findings and an ssrf cloud-metadata string to Medium, and extract-usage's EXTR_OVERWRITE to Low (#348)
• •validation-sql-injection, arbitrary-file-upload and directory-traversal report High where nothing proves user control (#349)
• •eval-usage, rce and cryptographic-weakness report High for calls PHP removed below 8.1 (#350)
• •pcntl-extension and redis-status raise a broken Redis to Critical, while the horizon-reliability, cache-busting and dead-routes static checks drop below it (#351)
• •cdn-configuration and policy-authorization report High and begin failing a default fail_on: high build (#351, #352, #354)
• •xdebug-enabled reports High rather than Critical (#342)
• •test-data-management returns to Low (#343)
• •Requires shieldci/laravel ^1.15.1 and shieldci/analyzers-core ^2.2, and declares guzzlehttp/guzzle ^7.0|^8.0 and psr/http-message ^1.0|^2.0 (#355, #358, #359)

Fixed

• •Thirteen analyzers stop naming config files the app never published, Laravel merging the framework's copy; these findings rehash, so regenerate the baseline once (#355)
• •cookie-domain reports a relative path with a line per setting, so a local baseline matches in CI and @shieldci-ignore works on it (#355)
• •redis-throttling and clickjacking name the middleware file the scanned project has, rather than the one the installed Laravel version implies (#359)
• •cookie-domain and cors-config explanations are corrected: a public-suffix cookie is rejected outright, and a credentialed wildcard echoes the request Origin (#343, #347)

Changed

• •Requires shieldci/laravel ^1.14 (was ^1.12.1) (#337)

Fixed

• •middleware-misuse confirms a class is an Eloquent model through EloquentModelDetector rather than matching a short-name allowlist, so a DTO, job or vendor class is no longer flagged (#337)
• •command-injection, directory-traversal, object-injection and xxe no longer fail a whole run with an error status when scanned code uses first-class callable syntax such as exec(...) (#338)

Fixed

• •test-coverage skips in production and staging unless a clover report is present, rather than flagging missing coverage artifacts that exist only in CI and development; a shipped report is read even when tests/ is not deployed (#334)

Fixed

• •gdpr-compliance scans controllers recursively and includes routes/api.php in its Article-20 data-export check, so a nested export controller and an export route there are detected rather than an API-first app being falsely flagged (#332)

Fixed

• •database-query-optimization and filament-table-optimization emit no false missing-index hint where MigrationIndexScanner now reads foreignUlid() and foreignUuid() with ->constrained(), and the raw foreign() builder in single and composite form, as FK-backed indexes (#330)

Fixed

• •shield:analyze memory no longer accumulates across pro analyzers: database-query-optimization, eager-loading, job-queue-config, octane-config, redis-throttling, gdpr-compliance and cashier-paddle each held a private parser whose cache survived the whole run, and each now releases it between analyzers (#328)

Fixed

• •test-quality collects assertion helpers across the whole tests directory in a first pass, so a Pest test verifying only through a global helper defined elsewhere, such as in tests/Pest.php, is no longer flagged as having no assertions (#324)
• •arbitrary-file-upload correlates a dot-notation or wildcard upload field such as profile.photo or documents.*.file to its validation rules, so it no longer falls into the assume-unvalidated branch whenever another file rule exists in the same file (#325)
• •database-query-optimization raises no missing-index hint for a primary-key column, id short-circuiting the check and MigrationIndexScanner now reading the *Increments family, including a custom-named key such as increments('legacy_id') (#326)
• •filament-table-optimization gains the same primary-key handling through the shared scanner (#326)

Changed

• •Requires shieldci/laravel ^1.12.1 (was ^1.12), for the shared ReadsConfigArrays trait that replaces pro's own copy (#322)

Changed

• •Requires shieldci/analyzers-core ^2.1 (was ^1.6) and shieldci/laravel ^1.12 (was ^1.10), adopting the analyzers-core 2.x line (#320)

Fixed

• •data-retention-policy emits one finding per unpruned model, each anchored to its own app/Models/<Model>.php, rather than bundling every model into one finding at the bare app/Models directory (#317)