vinceamstoutz/Symfony Security Auditor

AI-powered multi-agent security audit for Symfony applications — provider-agnostic via symfony/ai.

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Stale
License: None

Inputs

name	description	required	default
mode	How to run the audit: "bundle" (require the Symfony bundle in the target project via Composer, then run `bin/console audit:run`) or "standalone" (download the checksum-verified standalone binary — no bundle dependency needed in the target project). Composer + a host PHP are still required in standalone mode to fetch the provider bridge via `init`.	no	bundle
project-path	Path to the Symfony project to audit.	no	.
format	Output format: console, json, sarif, html, markdown, junit, or github.	no	sarif
output	File path to write the report to. Leave empty to print to stdout.	no	report.sarif
baseline	Path to a baseline file of accepted-finding fingerprints to suppress.	no	""
generate-baseline	If set to a path, run the audit, write the current findings to that baseline file, and exit 0.	no	""
since	Diff mode — audit only files changed against this git ref (e.g. origin/main).	no	""
fail-on	Minimum aggregate risk level (safe, low, medium, high, critical) that makes the audit exit 1. Leave empty to use the project's audit.fail_on configuration (default critical).	no	""
extra-args	Additional raw arguments appended verbatim to the audit:run invocation (e.g. "--path=src --no-cache").	no	""
php-version	PHP version to install (ignored when setup-php is false).	no	8.3
setup-php	Whether this action installs PHP via shivammathur/setup-php. Set to false if your workflow already set PHP up. Still required in standalone mode — a host PHP + Composer are needed to fetch the provider bridge via `init`.	no	true
install-dependencies	Whether this action runs `composer install` before auditing. Only applies in bundle mode; ignored in standalone mode. Set to false if your workflow already installed dependencies.	no	true
working-directory	Directory to run composer and the console command from.	no	.

Outputs

name	description
exit-code	The audit command's exit code (0 = passed, 1 = failed the fail-on gate, 2 = budget aborted).
report-path	The path the report was written to (mirrors the output input; empty when the report was printed to stdout).
findings-count	Total number of findings in the report. Only populated when format is json (empty for other formats).
highest-severity	The report's aggregate risk level (safe, low, medium, high, critical). Only populated when format is json (empty for other formats).