A general collection of items to consider

[paragonie-scott]

(I can send a pull request for any/all of these, if so desired):

• Framework Hardening
  • https://github.com/nbs-system/snuffleupagus - The spiritual successor to Suhosin (same goals, but without the bitrot of being abandoned, nor the arrogant communication style of some early PHP security authors)
  • https://github.com/Roave/SecurityAdvisories - Block known-vulnerable code from being installed (uses the FriendsOfPHP repository as a data source to create composer conflicts)
• Cryptography
  • https://github.com/paragonie/random_compat - stop using insecure RNGs, random_bytes() and random_int() are better! This polyfills the same interface for PHP 5 projects (though PHP 7.1 should be your minimum target these days)
  • https://github.com/paragonie/sodium_compat - Polyfills (most of) libsodium for projects running PHP <7.2
  • https://github.com/paragonie/ciphersweet/ - Searchable symmetric-key encryption (with IND-CCA3 security)

New category: Community

• https://www.reddit.com/r/phpsec - PHP Security subreddit
• (others?)

[prisis]

• Composer plugin

  • https://github.com/narrowspark/automatic-security-audit - A composer plugin that checks if your application has known security vulnerabilities. (uses the FriendsOfPHP/security-advisories repository as a data source)

• Security Database

  • https://github.com/narrowspark/security-advisories - FriendsOfPHP/security-advisories as a json file
  • https://github.com/FriendsOfPHP/security-advisories - A database of PHP security advisories

[streichsbaer]

Thanks for the comments @paragonie-scott and @prisis 🙏

Just looked through the list, please create a PR for:

• https://github.com/nbs-system/snuffleupagus under secure-headers
• r/phpsec under community (this can be a new category before companies)
• https://github.com/paragonie/sodium_compat under Tools > Security Libraries
• https://github.com/narrowspark/security-advisories: Let's add this one level indented under friends of PHP security-advisories.

Not sure about:

• https://github.com/paragonie/random_compat: PHP 5.x is pretty much end of life now (another 18 days). Let's leave it out for now.
• https://github.com/paragonie/ciphersweet/: Let's leave it out for now.
• https://github.com/narrowspark/automatic-security-audit: This seems to be similar to roave/SecurityAdvisories, right? Let's stick with the roave one for now, unless this is better somehow. Let me know your thoughts.

Already covered:

• https://github.com/Roave/SecurityAdvisories in Add roave/security-advisories as suggested dependency #4
• https://github.com/FriendsOfPHP/security-advisories

[prisis]

My security audit extends composer with a audit commit and and some composer events to show the information.

This is how it looks like
https://twitter.com/_prisis_/status/1037838889703104514?s=09

[streichsbaer]

@paragonie-scott can we close this issue now? Everything was taken care of?

[paragonie-scott]

Yep, looks great to me. :)