PHP application security audit: what we check before it is too late
Most leaks in small and mid-size companies come from old PHP panels that “everyone knows still work”. An audit is not an accusation — it is a list of risks you can close before someone uses them.
A typical story: the company has a panel from 2016. Sales, accounting and sometimes an intern log in. The admin password is in an email. PHP on the server is several versions behind. Nobody knows if last week’s backups exist. This is not malicious neglect — it is ordinary technical debt. Until someone breaks in, everything “works”.
What a GESOFT audit covers
1. The application
- Login: brute force, password reset, sessions, whether a known URL bypasses permissions.
- Forms and APIs: SQL injection, XSS, CSRF, file uploads (can someone upload a script).
- Secrets in code: database passwords, API keys, dumps in a public directory.
- Role permissions: whether a salesperson sees data they should not.
- Logs: whether you can reconstruct who deleted a record.
2. Dependencies and versions
We check PHP, Laravel (or another framework) and Composer/npm packages for known CVEs. Old Laravel 5.x or PHP 7.2 is an open door today — even if the business code is “fine”.
3. Server and deployment
- Whether .env and Git are public.
- Whether HTTPS is on, or a password can still be sent in clear text over HTTP.
- File permissions, SSH access, firewall, a dedicated database user with least privilege.
- Backups: they exist, they live off the server, someone has actually restored them.
Patch or rewrite?
Not every old app deserves a rewrite. If the business logic is clear and holes can be patched (PHP, Laravel, login, headers, backups) — we patch. We rewrite when:
- The framework is abandoned or the code is “PHP in one file” with no tests and no docs.
- Nobody can add a new feature safely.
- GDPR requirements (roles, deletion, consents) need a data-model rebuild.
- The cost of the next round of patches approaches the cost of a maintainable new version.
A new system is built on Laravel and we migrate the data. The old panel can run in parallel during the switch.
How the engagement works
We need access to the code (Git or an archive) and — for the server part — a limited account or a call with the administrator. We sign an NDA. The report is delivered on an agreed date, usually within a few working days for a typical panel.
If it “works but you are worried” — that is the right time for an audit, not the day after an attack. Tell us which system you want checked. We will say whether a review is enough or you need a repair plan straight away.
Describe your project