SaaSHub helps you find the best software and product alternatives Learn more →
Top 23 PHP Security Projects
-
Matomo
Empowering People Ethically 🚀 — Matomo is hiring! Join us → https://matomo.org/jobs Matomo is the leading open-source alternative to Google Analytics, giving you complete control and built-in privacy. Easily collect, visualise, and analyse data from websites & apps. Star us on GitHub ⭐️ – Pull Requests welcome!
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
-
Project mention: Why I built attack-chain correlation on top of Semgrep and Joern | dev.to | 2026-04-07
docker compose up curl -X POST http://localhost:8080/api/scans \ -H "Content-Type: application/json" \ -d '{"repo_url": "https://github.com/digininja/DVWA"}'
-
PrivateBin
A minimalist, open source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256 bits AES.
Project mention: I Audited the Privacy of Popular Free Dev Tools, the Results Are Terrifying | news.ycombinator.com | 2026-03-03 -
-
-
Project mention: Build Your Own Cybersecurity Toolkit: 5 Field-Tested Tools Every Analyst Should Master | dev.to | 2025-07-11
🔗 https://www.misp-project.org/
-
Passbolt
Passbolt Community Edition (CE) API. The JSON API for the open source password manager for teams!
Project mention: Bitwarden scrubs 'Always free' and 'Inclusion' values from its site | news.ycombinator.com | 2026-05-15Thoughts and reviews about Passbolt? TOTP handling seems a bit off, extensions are not mostly read-only (OK for me). But the "share a single secret" access control seems nice:
https://www.passbolt.com/pricing/pro
https://www.passbolt.com/vs/bitwarden/overview
https://www.passbolt.com/docs/hosting/install/
PHP backend (IMHO a downside): https://github.com/passbolt/passbolt_api. But There appears to be a significant amount of auditing behind Passbolt's security claims, assuming the information on https://www.passbolt.com/security is accurate.
-
-
-
-
PHPGGC
PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from command line or programmatically.
-
-
-
This also affected the PHP library, sodium_compat. https://github.com/FriendsOfPHP/security-advisories/pull/756
I'm planning to spend my evening checking every other Ed25519 implementation I can find to see if this check is missing any where else in the open source ecosystem.
-
-
mutillidae
OWASP Mutillidae II is a free, open-source, deliberately vulnerable web application providing a target for web-security training. This is an easy-to-use web hacking environment designed for labs, security enthusiasts, classrooms, CTF, and vulnerability assessment tool targets.
-
-
-
tirreno
Open security analytics. Understand, monitor, and protect your product from cyber threats, account takeovers, bots and abuse.
-
Latte
☕ Latte: the safest & truly intuitive templates for PHP. Engine for those who want the most secure PHP sites.
-
-
-
NOTE:
The open source projects on this list are ordered by number of github stars.
The number of mentions indicates repo mentiontions in the last 12 Months or
since we started tracking (Dec 2020).
PHP Security discussion
PHP Security related posts
-
Why I built attack-chain correlation on top of Semgrep and Joern
-
I Audited the Privacy of Popular Free Dev Tools, the Results Are Terrifying
-
Show HN: Self-destructing, end-to-end encrypted Pastebin
-
Making frontier cybersecurity capabilities available to defenders
-
Ask LLM: What you see in my product?
-
A Vulnerability in Libsodium
-
Show HN: Security Analytics for Your Product
-
A note from our sponsor - SaaSHub
www.saashub.com | 13 Jun 2026
Index
What are some of the best open-source Security projects in PHP? This list will help you:
| # | Project | Stars |
|---|---|---|
| 1 | Matomo | 21,592 |
| 2 | DVWA | 13,198 |
| 3 | PrivateBin | 8,376 |
| 4 | random_compat | 8,164 |
| 5 | awesome-appsec | 6,912 |
| 6 | MISP | 6,356 |
| 7 | Passbolt | 5,969 |
| 8 | pfSense | 5,667 |
| 9 | PHPSecLib | 5,573 |
| 10 | PHP Encryption | 3,872 |
| 11 | PHPGGC | 3,826 |
| 12 | bouncer | 3,576 |
| 13 | HTML Purifier | 3,347 |
| 14 | SensioLabs Security Check | 2,126 |
| 15 | Sentinel | 1,524 |
| 16 | mutillidae | 1,489 |
| 17 | IniScan | 1,468 |
| 18 | wp2static | 1,460 |
| 19 | tirreno | 1,403 |
| 20 | Latte | 1,282 |
| 21 | Optimus | 1,276 |
| 22 | PHP-Auth | 1,237 |
| 23 | TwoFactorAuth | 1,179 |
Sponsored
SaaSHub - Software Alternatives and Reviews
SaaSHub helps you find the best software and product alternatives
www.saashub.com