Top 23 PHP Security Projects

Security

• Add a project

1. Matomo

   1 158 21,942 9.9 PHP

   Empowering People Ethically 🚀 — Matomo is hiring! Join us → https://matomo.org/jobs Matomo is the leading open-source alternative to Google Analytics, giving you complete control and built-in privacy. Easily collect, visualise, and analyse data from websites & apps. Star us on GitHub ⭐️ – Pull Requests welcome!

   

   Project mention: 25 Trending Self-Hosted Projects on GitHub | dev.to | 2026-04-02

2. AppSignal

   www.appsignal.com sponsored

   AppSignal knows why the f*#k it crashed. Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise.

   

3. DVWA

   2 44 13,788 7.1 PHP

   Damn Vulnerable Web Application (DVWA)

   

   Project mention: Run Your Own Free WAF in Docker with SafeLine | dev.to | 2026-10-04

   SafeLine on GitHub- Official docs: deployment- Official docs: adding an application- How SafeLine's syntax analysis works- Edition comparison (Plan)- DVWA on GitHub- OWASP Top 10:2025 — A05 Injection- OWASP Core Rule Set- BlazeHTTPOriginally published at pabpereza.dev. Watch the full video (in Spanish) on YouTube.

4. PrivateBin

   3 167 8,658 9.7 PHP

   A minimalist, open source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256 bits AES.

   

   Project mention: Sin backend: cómo bigwords.page guarda todo en la URL | dev.to | 2026-10-08

5. random_compat

   4 0 8,147 3.1 PHP

   PHP 5.x support for random_bytes() and random_int()

   

6. awesome-appsec

   5 6 7,027 3.4 PHP

   A curated list of resources for learning about application security

   

7. MISP

   6 32 6,590 10.0 PHP

   MISP (core software) - Open Source Threat Intelligence and Sharing Platform

   

8. Passbolt

   7 41 6,151 9.9 PHP

   Passbolt Community Edition (CE) API. The JSON API for the open source password manager for teams!

   

   Project mention: Bitwarden scrubs 'Always free' and 'Inclusion' values from its site | news.ycombinator.com | 2026-05-15

   Thoughts and reviews about Passbolt? TOTP handling seems a bit off, extensions are not mostly read-only (OK for me). But the "share a single secret" access control seems nice:

   https://www.passbolt.com/pricing/pro

   https://www.passbolt.com/vs/bitwarden/overview

   https://www.passbolt.com/docs/hosting/install/

   PHP backend (IMHO a downside): https://github.com/passbolt/passbolt_api. But There appears to be a significant amount of auditing behind Passbolt's security claims, assuming the information on https://www.passbolt.com/security is accurate.

9. SaaSHub

   www.saashub.com sponsored

   SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

   

10. pfSense

    8 187 5,749 9.5 PHP

    Main repository for pfSense

    

11. PHPSecLib

    9 12 5,597 9.6 PHP

    PHP Secure Communications Library

    

12. PHPGGC

    10 4 3,893 7.0 PHP

    PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from command line or programmatically.

    

13. PHP Encryption

    11 3 3,879 5.6 PHP

    Simple Encryption in PHP.

    

14. bouncer

    12 12 3,576 3.4 PHP

    Laravel Eloquent roles and abilities.

    

15. HTML Purifier

    13 13 3,350 4.9 PHP

    Standards compliant HTML filter written in PHP

    

16. SensioLabs Security Check

    14 5 2,143 8.5 PHP

    A database of PHP security advisories

    

    Project mention: A Vulnerability in Libsodium | news.ycombinator.com | 2025-12-30

    This also affected the PHP library, sodium_compat. https://github.com/FriendsOfPHP/security-advisories/pull/756

    I'm planning to spend my evening checking every other Ed25519 implementation I can find to see if this check is missing any where else in the open source ecosystem.

17. tirreno

    15 27 1,541 5.6 PHP

    tirreno is a security framework. Event tracking, threat detection, and risk scoring for any product.

    

    Project mention: Ask HN: Did GitHub remove the stargazers list? | news.ycombinator.com | 2026-08-05

    GitHub seems to be continuing to deprecate star information. First the stargazers list was hidden from logged-out users, and now the main stargazers link on repo pages has disappeared too. /stargazers returns a 404 (1) unless you own the repo.

    I know many people say stars aren't a real signal, but they were: they made it possible to detect signs of bought stars. Some third-party services even showed the geographic distribution of a repo's stars so you could judge whether they looked fake.

    The main point is that whatever reasoning GitHub offers, the outcome is the same: either GitHub is weak against bots, or it would rather control these signals itself, with no way for outsiders to audit them.

    1. https://github.com/tirrenotechnologies/tirreno/stargazers

18. mutillidae

    16 5 1,529 6.4 PHP

    OWASP Mutillidae II is a free, open-source, deliberately vulnerable web application providing a target for web-security training. This is an easy-to-use web hacking environment designed for labs, security enthusiasts, classrooms, CTF, and vulnerability assessment tool targets.

    

19. Sentinel

    17 1 1,527 1.6 PHP

    A framework agnostic authentication & authorization system. (by cartalyst)

    

20. IniScan

    18 0 1,468 0.0 PHP

    A php.ini scanner for best security practices

    

21. wp2static

    19 22 1,465 3.3 PHP

    WordPress static site generator for security, performance and cost benefits

    

22. php-casbin

    20 1 1,341 5.0 PHP

    An authorization library that supports access control models like ACL, RBAC, ABAC in PHP .

    

    Project mention: One-Line Defense Against BOLA: Killing Data-Level if-else Hell with PHP-Casbin | dev.to | 2026-09-10

    Stop cluttering your business logic with defensive, error-prone ownership checks. By leveraging object-level ABAC in PHP-Casbin, you can extract permission rules into a clean declarative model. You will shut down BOLA vulnerabilities before they hit production, and you will save your team countless hours of frustrating bug-hunting down the road.

23. Latte

    21 10 1,291 8.7 PHP

    ☕ Latte: the safest & truly intuitive templates for PHP. Engine for those who want the most secure PHP sites.

    

24. Optimus

    22 2 1,276 2.4 PHP

    🤖 Id obfuscation based on Knuth's multiplicative hashing method for PHP.

    

25. PHP-Auth

    23 9 1,243 8.2 PHP

    Authentication for PHP. Simple, lightweight and secure.

    

26. SaaSHub

    www.saashub.com sponsored

    SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

    

PHP Security related posts

• How to Build a Safe, Isolated Cybersecurity Home Lab (Kali + Ubuntu)

  2 projects | dev.to | 20 Sep 2026

• Ask HN: Did GitHub remove the stargazers list?

  1 project | news.ycombinator.com | 5 Aug 2026

• Show HN: Flashpaper – Self-destructing secret sharing with no database

  3 projects | news.ycombinator.com | 28 Jul 2026

• Ask HN: Is GitHub preparing to go behind a paywall?

  1 project | news.ycombinator.com | 7 Jul 2026

• Why I built attack-chain correlation on top of Semgrep and Joern

  2 projects | dev.to | 7 Apr 2026

• I Audited the Privacy of Popular Free Dev Tools, the Results Are Terrifying

  2 projects | news.ycombinator.com | 3 Mar 2026

• Show HN: Self-destructing, end-to-end encrypted Pastebin

  2 projects | news.ycombinator.com | 2 Mar 2026
• A note from our sponsor - SaaSHub
  www.saashub.com | 12 Oct 2026

  SaaSHub helps you find the best software and product alternatives Learn more →

Index

Sponsored

AppSignal knows why the f*#k it crashed.

Stop vibe-debugging. Every exception, every backtrace, grouped so you see patterns, not noise.

www.appsignal.com

Do not miss the trending PHP projects with our weekly report!