Bastet

Static security scanner for PHP projects.

Bastet CLI tool helps find vulnerabilities that type-checking tools may miss, including SQL injection, cross-site scripting, command injection, unsafe file handling, hardcoded secrets, weak security settings, and other dangerous application patterns. It remains usable on generic PHP applications. It ships as a Composer package with a vendor/bin/bastet executable.

Bastet complements tools such as PHPStan and Psalm:

PHPStan and Psalm focus primarily on type safety and code correctness. Bastet focuses on whether data can flow into dangerous operations or insecure application behavior.

An example PHP security workflow is:

PHPStan or Psalm → code correctness

Bastet → source-code security

Composer Audit → dependency vulnerabilities

Bastet is especially useful for legacy PHP, procedural applications, custom frameworks, inherited projects, and teams that want a focused security scan without configuring a full enterprise SAST platform.

It can be added to local development and CI pipelines to identify security risks before code reaches production.

Install

composer config repositories.bastet vcs https://github.com/trafficinc/bastet.git
composer require trafficinc/bastet:dev-main

(Coming soon on packagist)

composer require --dev trafficinc/bastet

Usage

vendor/bin/bastet .
vendor/bin/bastet app
vendor/bin/bastet . --min-severity high
vendor/bin/bastet . --format json --output bastet-report.json

Framework Support

Bastet scans generic PHP code, but some rules include framework-aware heuristics to improve signal for wayfinder-core style applications and similar PHP projects.

For example, XSS detection treats explicit HTML escaping such as htmlspecialchars(...) and e(...) as safe output patterns.

Options

Flag	Short	Description
--target <path>	-t	Directory or file to scan
--format <fmt>	-f	console or json
--output <file>	-o	Write report to file instead of stdout
--min-severity <s>	-s	Minimum severity: critical high medium low info
--exclude <pattern>	-e	Exclude paths matching pattern
--no-color		Disable ANSI color output
--list-rules		Print all rule IDs and exit
--help	-h	Print help and exit

For Wayfinder/Stackmint apps, scanning the project root is preferred. If you scan the app directory directly, Bastet also includes sibling resources/views so developer-owned templates are covered by the current view convention.

Suppressing Findings

Use targeted suppression comments when a finding is intentional. Suppressions require a rule ID, or all for rare broad exceptions.

// bastet-ignore-next-line SEC009 -- intentionally evaluating trusted admin script
eval($script);

eval($script); // bastet-ignore-line SEC009 -- intentionally evaluating trusted admin script

// bastet-ignore-file SEC009 -- generated compatibility fixture

Supported forms:

• bastet-ignore-next-line <rule-id>
• bastet-ignore-line <rule-id>
• bastet-ignore-file <rule-id>

Multiple rule IDs can be separated with spaces or commas. Add a short reason after -- so suppressions are auditable.

Exit codes

Code	Meaning
0	No findings at High severity or above
1	One or more High or Critical findings
2	Invalid arguments or target not found

Development

The scanner is now hybrid:

• src/Analysis/, src/Parsing/, src/SecurityAst/, src/Flow/, and src/Taint/ contain the AST and taint analysis engine
• src/Checkers/ contains sink-specific analyzers for SQL injection, XSS, command injection, and file inclusion/path traversal
• src/Rules/ still contains regex/config-style checks that are useful outside the AST-backed path
• src/Core/ and src/Reporting/ keep the CLI, finding model, orchestration, and output format stable
• tests/run.php executes fixture-based regression tests for the AST taint pipeline

Run local Bastet tests with:

php tests/run.php

See docs/ADDING_RULES.md for the extension workflow.