Skip to main content
155 analyzers · 7 ticket providers · Full REST API

Everything that ships for Laravel applications

Five analyzer categories tuned to Laravel's conventions. Plus an assignment lifecycle, multi-provider ticketing, shareable reports, and a full REST API.

Comprehensive coverage

155 Laravel analyzers across 5 categories

73 free, 82 pro. Each check understands Laravel's idioms, from Eloquent queries and Blade directives to middleware and service providers.

Security

67

XSS, SQL injection, CSRF, authentication, and authorization vulnerabilities

Performance

33

N+1 queries, missing indexes, caching opportunities, and optimization hints

Best Practices

19

Laravel conventions, design patterns, and idiomatic framework usage

Code Quality

8

Naming conventions, code organization, and structural consistency

Reliability

28

Error handling, logging standards, and deployment readiness checks

Issue lifecycle

From open to verified, without losing context

Every issue gets a permalink, a timeline, and a history: assignments, comments, ticket links, and verifications all on one page.

Performance · high

N+1 query in PostsController@index

app/Http/Controllers/PostsController.php:47
verified
  1. Eloquent N+1 Query Analyzer·
    Detected N+1 query in PostsController@index : iterating 24 posts without eager-loading authors.
  2. 3 min later
    mike·
    Assigned to @jane · due in 3 days · marked in-progress.
  3. 1 day later
    jane·
    “Will switch to ->with('author'). Lands in the next cache clear.”
  4. 5 min later
    jane·
    Linked to Jira SHLD-421
  5. 18 h later
    jane·
    Resolved in commit a3f2e9c, switching to eager-load via with().
  6. 2 h later
    ShieldCI·
    Re-analysis verified. No longer detected.
    Project score87%87%+7

Integrate everywhere

Ticket where your team already lives

Two git hosts, seven ticket providers, three alert channels. Configure once per project; ShieldCI handles the rest.

Version control

2 hosts

GitHub App

Official app · PR checks · line comments

GitLab

MR pipelines · inline review comments

Ticketing

7 providers

Jira

ADF-formatted descriptions · severity mapping

Linear

Workflow-state mapping · priority sync

GitHub Issues

Labels · assignees · project picker

Asana

Custom fields · section routing

GitLab Issues

Labels · milestones · emoji severity

ClickUp

Custom fields · status mapping

Generic Webhook

Any HTTP endpoint · configurable JSON

Alerts & notifications

3 channels

Slack

Per-project channels · severity filtering

Discord

Webhook-based · rich embeds

Email

Digest or per-event · rate-limited

Error tracking

3 detected

Sentry

Detected via sentry/sentry-laravel · ShieldCI adapts alerts to avoid duplication

Flare

Spatie's Laravel error tracker · detected as monitoring tool

Ignition

Spatie dev error page · flagged if misconfigured for production

Automate anything

A REST API for everything the dashboard does

25+ Sanctum-authenticated endpoints with hierarchical token abilities (read · write · admin) and plan-tier rate-limit multipliers. Build CI jobs, internal dashboards, and ticket automations without leaving your stack.

Terminal
▊
200 OK · application/json
{
  "data": [
    {
      "id": "b257ec94-50b3-4979-a15f-4c40dee07dfe",
      "name": "checkout-api",
      "laravel_version": "12",
      "latest_report": {
        "score": 94,
        "passed": 151,
        "failed": 3,
        "warnings": 2,
        "issues_by_severity": {
          "critical": 0,
          "high": 1,
          "medium": 2,
          "low": 5
        },
        "package_version": "v1.7.1",
        "analyzed_at": "2026-04-22T14:21:03Z"
      }
    }
  ],
  "meta": { "current_page": 1, "per_page": 20, "total": 12 }
}

CI/CD Integration

Seamless pipeline integration

Add ShieldCI to your existing workflow. Get feedback on every commit and block merges that introduce security issues.

GitHub Actions

Ready-to-use workflow files for automated analysis on every push and pull request.

- name: Run ShieldCI
  run: php artisan shield:analyze --ci --report

GitLab CI/CD

Native GitLab CI integration with merge request comments and pipeline status.

shieldci:
  script:
    - php artisan shield:analyze --ci --report

Scheduled Analysis

Configure automatic nightly or weekly scans of your codebase with email reports.

Schedule::command('shield:analyze --report --triggered-by=scheduled')
  ->daily();

Ecosystem intelligence

Analyzers built around your actual stack

ShieldCI knows the packages your app uses and applies package-specific analysis, not generic checks.

Platform Awareness

Adapts to your deployment target

  • Laravel Vapor: Suppresses Horizon alerts on Lambda; adjusts cache, session & queue recommendations
  • Laravel Cloud: Adapts recommendations to Cloud's managed environment
  • Laravel Forge: Server-provisioning context for relevant checks

Real-time, Queue & Infrastructure

Deep coverage where concurrency meets production

  • Reverb: WebSocket security
  • Horizon: Security + operational reliability
  • Redis: Eviction policy, shared DB isolation, rate limiting, throttling

Auth & Frontend Security

7 dedicated security analyzers across every major auth path and frontend framework

SanctumPassportFortifySocialiteNovaLivewireInertia.js
Filament8 analyzers

The deepest Filament-specific analysis available, covering authorization, tenancy isolation, and query optimization patterns specific to Filament's architecture.

Panel Security
Resource Authorization
Widget Security
Form Validation
Navigation
Custom Pages
Tenancy
Table Optimization

Compliance & audit

Built for teams with audit requirements

ShieldCI ships analyzers for the four frameworks enterprise teams most commonly audit against.

GDPR

View analyzer →

Data handling, consent patterns, and retention policies analyzed against GDPR requirements.

SOC2

View analyzer →

Audit logging patterns checked for SOC2 Type II readiness.

HIPAA

View analyzer →

Data retention and access control patterns validated for HIPAA compliance.

PCI-DSS

View analyzer →

Payment data handling and API key security checked against PCI-DSS requirements.

Comparison

Why Laravel teams choose ShieldCI

Laravel 9+. PHPStan Level 9 · Built like your team builds.

FeatureShieldCIPHPStan / LarastanManual Review
Laravel-specific checksType safety only—
Security scanning—Varies
Performance analysis——
Issue lifecycle tracking—Manual
Multi-provider ticket sync (7 providers)——
Public report sharing——
Environment-aware scoring——
Historical reports & trends——
Team collaboration——
Actionable fix guidance—Varies
Open-source optionN/A
REST API (Sanctum)——

Close the loop on every finding.

Install the open-source package in minutes. Add the cloud dashboard for team assignments, ticket sync, and shareable reports.

Get Started
View Documentation
or install the free package