Hostile Adversarial Vulnerability & Oversight Check
Framework-aware security scanning that finds real vulnerabilities — not generic noise. Understands your Laravel policies, Gates, and Eloquent scoping. Runs on every PR.
1 Measured on Koel
at pinned commit 41cab99 — 1,084 PHP files, 649–813 ms across three runs.
Analysis time only; excludes clone and dependency install. Reproduce it:
npx @havoc-security/cli scan and read metadata.durationMs.
Generic tools flag hundreds of phantom issues. HAVOC understands your framework's security model and finds gaps that actually matter.
Understands Laravel policies, Gates, middleware, and Eloquent scoping. Not just regex — real AST analysis of your framework's security model.
Track what % of your endpoints have security checks — like code coverage, but for auth. Trending over time so you can see progress.
Auto-generates PHPUnit tests that prove vulnerabilities exist. These tests become your regression suite — not just findings.
Inline findings on the exact lines that need attention, just like Codecov. Coverage delta in every PR description.
Send any finding to an LLM for a second opinion. You get a classification — true positive, false positive, or needs review — with a confidence score and written reasoning, so you can see the argument rather than just a verdict.
One-click fix generation for common security patterns. HAVOC opens the PR, you review and merge.
One command gets you scanning. Works with npm, Composer, or as a standalone binary. Zero config required to get your first results.
HAVOC auto-detects your framework and runs 15 specialized analyzers. Results in seconds, not hours. Authorization coverage calculated across every controller method.
Diff-aware in CI — only scans changed files in PRs, but reports overall coverage from the last full scan.
Each finding includes an explanation, a code fix, and links to OWASP/CWE documentation. Auto-fix PRs for common patterns. Exploit tests as regression suite.
View sample finding →Missing authorization gate
TransactionController.php:142
+ $this->authorize('bulkConfirm', $project);
HAVOC posts inline comments on the exact lines with issues — just like Codecov. Your team sees security findings in context, not buried in a separate dashboard.
No credit card required to start. Upgrade when you need the cloud dashboard and advanced features.
Full scanning power for personal and side projects. No credit card. No trial. No catch.
For independent developers who need full scanning power.
For teams who need AI-powered security and full automation.
Unlimited scale with enterprise-grade controls.
Self-hosted, SLA, audit logs, and dedicated security support.
The CLI and GitHub Action run all 15 analyzers, generate authorization coverage reports, and post inline PR comments — completely free. No account required for local scans.
✅ Free — always
🔓 Paid — adds
Snyk and Semgrep are generic tools — they treat all code the same. HAVOC is built around your framework's security model. It knows that a missing $this->authorize() in a Laravel controller is a real vulnerability, not a suggestion. This framework-awareness means fewer false positives and more real findings.
No. Code is cloned for scanning and deleted immediately after. We store scan results (findings, coverage metrics, metadata) — never your source code. Enterprise customers can use the self-hosted scanner, which means your code never leaves your network.
HAVOC supports Laravel (PHP). All 15 analyzers are Laravel-specific: authorization coverage, mass assignment, XSS surfaces, SQL injection, IDOR, privilege escalation, credential exposure, session security, file uploads, rate limiting, encryption at rest, insecure deserialization, open redirects, security headers, and dependency auditing. Symfony, Rails and Django are not supported today — HAVOC declines to scan them rather than apply Laravel rules to code they do not fit.
HAVOC parses every public controller method and checks whether it has an authorization check — $this->authorize(), Gate::, can(), or middleware on the route. It reports a percentage (e.g. "94.2% of 147 methods") and which specific methods are missing checks. Think of it like code coverage, but for security.
Yes! The CLI and GitHub Action are completely free and don't require a HAVOC Cloud account. You get terminal output, PR comments, and commit status checks. The cloud dashboard adds history, trends, team features, and AI-powered enhancements on top.
All paid plan features are available free for 14 days — no credit card required. After the trial, you can stay on the Free tier or subscribe to a paid plan. We don't lock you out or hold your scan history hostage.
🔴 HAVOC Security Report
2 new findings in feature/bulk-transactions
Authorization Coverage