php-security-reviewlisted

# PHP Security Review > "Security is not a product, but a process." > — Bruce Schneier ## Core Philosophy Shared across the `dotnet` / `python` / `php` / `rust` security reviews — same values, language-specific threats. | # | Value | What it means | |---|-------|---------------| | 1 | **Validate at boundaries** | Every external input validated and typed at the edge; never trust client data. | | 2 | **Parameterized queries only** | No string-concatenated SQL; bound parameters everywhere. | | 3 | **Secrets out of code** | No hardcoded secrets; env / secret-manager; never logged. | | 4 | **Authn/authz at every boundary** | Authentication and authorization enforced server-side at each trust boundary; deny by default. | | 5 | **Least privilege & safe defaults** | Minimal permissions; secure defaults; fail closed. | | 6 | **Protect data in transit & at rest** | No sensitive data (passwords, tokens, PII) in logs; TLS; encryption at rest. | | 7 | **Dependencies pinned & audited** | Versions pinned; CVE scan in CI; supply chain reviewed. | | 8 | **Evidence-based, graded findings** | Every finding cites `file:line` + OWASP category + severity; report is graded and manager-readable. | ## Workflow Shared skeleton: `DETECT → SCAN → EXECUTIVE SUMMARY → GRADED FINDINGS`. ``` DETECT Framework (Laravel/Symfony/plain + version), entry points (routes, controllers, jobs, console commands), and the data stores / external calls in scope. SCAN Walk the PHP Threat Checkl