Symfony 安全审计

Getting Started

The auditor ships two maintained ways to run it — pick the one that fits:

• Standalone CLI (recommended) — one download, configured once, audits any project with zero footprint in it (like PHPStan or Psalm). Best for most users, and for auditing a project you don't want to add a dependency to.
• Symfony bundle — wired into a Symfony app via Flex. Pick this to extend the auditor (custom services, decorated ports) or to pin it in the app's dev dependencies.

[!TIP] Both expose the same audit command, options, and output formats — see the CLI reference — and both can serve the auditor to your AI assistant over MCP.

1. Install

One command — Linux, macOS, and Windows (under WSL):

curl -fsSL https://raw.githubusercontent.com/vinceAmstoutz/symfony-security-auditor/main/install.sh | sh

install.sh detects your OS and CPU architecture, downloads the matching binary, and verifies its SHA-256 checksum before installing — anywhere you have a POSIX shell.

Native Windows (PowerShell) — when you are not using WSL; Git Bash / MSYS / Cygwin users need this installer too (install.sh detects those shells and points here):

irm https://raw.githubusercontent.com/vinceAmstoutz/symfony-security-auditor/main/install.ps1 | iex

[!TIP] One command, installed and configured. Set SSA_INIT=1 and the installer runs the guided init for you right after downloading, so you skip step 2. With a terminal attached it prompts for your provider and offers to store your API key at the end, leaving you ready to audit; in a pipe or CI it takes the Anthropic defaults and stores no key, so export one or run auth:set before auditing. init fetches the provider bridge with composer, so composer must be available for this combined step.

> curl -fsSL https://raw.githubusercontent.com/vinceAmstoutz/symfony-security-auditor/main/install.sh | SSA_INIT=1 sh
> 

Or download the binary for your platform straight from the latest release:

Every binary ships with a .sha256 checksum, and the install scripts abort rather than install a binary they cannot verify. To check a manual download yourself:

sha256sum -c symfony-security-auditor-linux-x86_64.sha256

1. Install — Symfony Flex wires everything

Installing the bundle requires PHP 8.3+ and Symfony 7.4+ in the host application (see composer.json) — the standalone binary has no such requirement, since it bundles its own runtime.

composer require --dev vinceamstoutz/symfony-security-auditor

The official Flex recipe registers the bundle (dev/test) and drops a pre-configured config/packages/symfony_security_auditor.yaml.

Not using Flex? See Manual setup.

2. Install a platform bridge

```bash

2. Configure — the guided `init`

symfony-security-auditor init

Writes the config file (~/.config/symfony-security-auditor/config.yaml on Linux/macOS, %APPDATA%\symfony-security-auditor\config.yaml on Windows), downloads the provider bridge you pick, and finally asks for your API key — pasted invisibly, never echoed, never in your shell history. init fetches that bridge with composer, so composer must be available for this one-time setup step; running audits afterward needs only the binary. The file is rootless (the same keys as the bundle, without the symfony_security_auditor: wrapper) plus a platform: block handed verbatim to symfony/ai. See configuration for the format and provider switching.

Press Enter at the key prompt to skip it — you can store the key any time with auth:set, or keep using an environment variable and store nothing at all.

read the key your config references & keep it out of your shell history

printf 'Anthropic API key: '; read -rs ANTHROPIC_API_KEY; echo export ANTHROPIC_API_KEY ```

[!TIP] Storing nothing is a perfectly good choice. Providing the API key covers the environment variable, a mounted secret file (%env(file:…)%), a password manager, and a CI secret store — and how they rank against the stored key.

3. Configure the platform

```yaml

config/packages/ai.yaml (or e.g. config/packages/ai_anthropic_platform.yaml)

ai: platform: anthropic: api_key: '%env(ANTHROPIC_API_KEY)%' ```

4. Adjust the auditor config

The Flex recipe already created this file — pick your model:

```yaml

config/packages/symfony_security_auditor.yaml

symfony_security_auditor: model: 'claude-opus-5'

Optionally pick a one-knob preset — `fast`, `balanced` (default), or `thorough`:

config/packages/symfony_security_auditor.yaml

symfony_security_auditor: profile: 'fast' ```

A profile only fills the keys you leave unset — any explicitly configured key always wins. See Cost & Performance for exactly what each profile sets.

config/packages/ai.yaml

ai: platform: generic: my_gateway: base_url: '%env(GATEWAY_URL)%' api_key: '%env(GATEWAY_TOKEN)%' ```

See Configuration → Instance-keyed platforms.

FAQ

How much does an audit cost? Depends on project size and model. A medium Symfony app (~150 files) on Claude Opus + Haiku split-model with prompt caching enabled costs roughly $0.50 per nightly run. See CI → Managing LLM Costs.

Does it send my code to the cloud? Only to the LLM provider you configure, and credential-shaped strings are scrubbed first (see Security by design). For zero-cloud operation, use the Ollama local platform.

Full FAQ — privacy, false positives, model picks, comparisons: docs/faq.md.