SaaSHub helps you find the best software and product alternatives Learn more →
Top 23 PHP Security Projects
-
Matomo
Empowering People Ethically 🚀 — Matomo is hiring! Join us → https://matomo.org/jobs Matomo is the leading open-source alternative to Google Analytics, giving you complete control and built-in privacy. Easily collect, visualise, and analyse data from websites & apps. Star us on GitHub ⭐️ – Pull Requests welcome!
As an open-source cloud and on-premise tool, Matomo gives users complete control over their data, allowing them to host it on their servers and comply with privacy regulations such as GDPR.
-
CodeRabbit
CodeRabbit: AI Code Reviews for Developers. Revolutionize your code reviews with AI. CodeRabbit offers PR summaries, code walkthroughs, 1-click suggestions, and AST-based analysis. Boost productivity and code quality across all major languages with each PR.
-
Project mention: Cybersecurity Beginner's Guide: Build Your Own Vulnerable Lab in 5 Minutes (DVWA + More) | dev.to | 2025-04-17
Step 2: Deploy DVWA (Damn Vulnerable Web App) DVWA is a classi learning platform containing common vulnerabilities like XSS, SQLi, CSRF, and file upload flaws. ✓Installation Steps:https://github.com/digininja/DVWA.git 1.Move DVWA into ServBay’s root directory (/Applications/ServBay/www/) Then modify the config.inc.php.dist file suffix to config.inc.php, and modify the database user name and password. Other configurations do not need to be changed.
-
-
PrivateBin
A minimalist, open source online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256 bits AES.
Project mention: We build Dropbud, place to upload files without uploading | news.ycombinator.com | 2025-02-23 -
-
Project mention: Cradle – Open-Source Collaborative Threat Intelligence Hub | news.ycombinator.com | 2025-03-15
-
-
InfluxDB
InfluxDB high-performance time series database. Collect, organize, and act on massive volumes of high-resolution data to power real-time intelligent systems.
-
>I'm currently upgrading my home network, trying various options, and one of the headaches is provenance of the equipment.
If you're concerned about provenance (or even if you're not), I suggest using a general purpose device and rolling your own ala pfSense[0]/OPNSense[1], etc, or just use one of the BSDs or Linux and use native tools or one of the many router/firewall distros[2]
[0] https://www.pfsense.org/
[1] https://opnsense.org/
[2] https://en.wikipedia.org/wiki/List_of_router_and_firewall_di...
-
Passbolt
Passbolt Community Edition (CE) API. The JSON API for the open source password manager for teams!
-
-
-
PHPGGC
PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from command line or programmatically.
Once we verify that the application uses this library in this specific version (usually through the composer.json file), we can test for insecure deserialization in an image upload route, for example. But first we need to create the gadget with the PHPGGC collection:
-
-
-
-
-
-
mutillidae
OWASP Mutillidae II is a free, open-source, deliberately vulnerable web application providing a target for web-security training. This is an easy-to-use web hacking environment designed for labs, security enthusiasts, classrooms, CTF, and vulnerability assessment tool targets.
-
-
Latte
☕ Latte: the safest & truly intuitive templates for PHP. Engine for those who want the most secure PHP sites.
-
-
-
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
NOTE:
The open source projects on this list are ordered by number of github stars.
The number of mentions indicates repo mentiontions in the last 12 Months or
since we started tracking (Dec 2020).
PHP Security discussion
PHP Security related posts
-
Cybersecurity Beginner's Guide: Build Your Own Vulnerable Lab in 5 Minutes (DVWA + More)
-
Build a Cyber Range in 5 Minutes: Unlock Your First Step to Becoming a Hacking Pro! (Save This Guide)
-
Montando um laboratório de Pentest com um celular Android e Kali Linux
-
Setting up a pentest lab with an Android Phone and Kali Linux
-
PHAR Deserialization in Monolog 2.7
-
We build Dropbud, place to upload files without uploading
-
PrivateBin – OSS pastebin where the server has zero knowledge of pasted data
-
A note from our sponsor - SaaSHub
www.saashub.com | 22 Apr 2025
Index
What are some of the best open-source Security projects in PHP? This list will help you:
| # | Project | Stars |
|---|---|---|
| 1 | Matomo | 20,422 |
| 2 | DVWA | 11,055 |
| 3 | random_compat | 8,176 |
| 4 | PrivateBin | 7,081 |
| 5 | awesome-appsec | 6,496 |
| 6 | MISP | 5,639 |
| 7 | PHPSecLib | 5,457 |
| 8 | pfSense | 5,184 |
| 9 | Passbolt | 4,960 |
| 10 | PHP Encryption | 3,823 |
| 11 | bouncer | 3,507 |
| 12 | PHPGGC | 3,431 |
| 13 | HTML Purifier | 3,152 |
| 14 | SensioLabs Security Check | 2,073 |
| 15 | Sentinel | 1,523 |
| 16 | IniScan | 1,482 |
| 17 | wp2static | 1,432 |
| 18 | mutillidae | 1,337 |
| 19 | Optimus | 1,268 |
| 20 | Latte | 1,179 |
| 21 | PHP-Auth | 1,152 |
| 22 | Halite | 1,133 |
| 23 | TwoFactorAuth | 1,119 |
Sponsored
CodeRabbit: AI Code Reviews for Developers
Revolutionize your code reviews with AI. CodeRabbit offers PR summaries, code walkthroughs, 1-click suggestions, and AST-based analysis. Boost productivity and code quality across all major languages with each PR.
coderabbit.ai