Getting Started with HAVOC

HAVOC is a framework-aware security scanner that understands your Laravel application's security model. Unlike generic SAST tools, HAVOC knows what a missing $this->authorize() call means in context — and only flags what's actually exploitable.

Open core — The CLI and GitHub Action are free and open source. The cloud dashboard (history, trends, AI features) is a paid add-on.

Quickstart

Install the CLI

Install globally via npm:

npm install -g @havoc-security/cli

# Verify
havoc --version  # havoc v1.0.0

Or run without installing: npx @havoc-security/cli scan

Run your first scan

From the root of your Laravel project:

havoc scan

HAVOC auto-detects your framework and runs all 9 analyzers. Results appear within 30 seconds.

Add to CI

Create .github/workflows/havoc.yml:

name: HAVOC Security Scan
on: [push, pull_request]

jobs:
  havoc:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@@v4
      - uses: havoc-security/scan-action@@v1
        with:
          api-key: {{ secrets.HAVOC_API_KEY }}

Connect to the cloud (optional)

havoc auth login

Enables dashboard, historical trends, AI triage, and team features.

Installation

npm (recommended)

npm install -g @havoc-security/cli

Composer

composer global require havoc/cli
# or dev dependency:
composer require --dev havoc/cli

Binary downloads

Standalone binaries for macOS, Linux, and Windows are on the releases page.

System requirements

Requirement	Minimum	Notes
Node.js	18.x	Required for npm install
PHP	8.1	Required to scan PHP projects
Git	Any	For diff-aware CI scanning

Your First Scan

When you run havoc scan, HAVOC:

Detects your framework from composer.json
Parses PHP files into an AST
Runs all 9 analyzers
Deduplicates findings
Calculates authorization coverage %
Outputs results to terminal or cloud

Understanding output

🔴 HIGH  [HAVOC-001] Missing authorization gate
   TransactionController.php:142
   bulkConfirm() has no $this->authorize() call

🟡 MED   [HAVOC-002] Unescaped Blade output
   resources/views/investor/show.blade.php:23

──────────────────────────────────────────
  Authorization Coverage: 132/147 (89.8%)
  Findings: 1 High · 1 Medium · 1 Low
  Scan time: 18.4s

Severity levels

Severity	Meaning	Action
Critical	Exploitable, likely data breach	Fix before merging
High	Real vulnerability, exploitable with context	Fix before release
Medium	Vulnerability exists, exploitability varies	Fix within sprint
Low	Defense-in-depth gap	Fix when convenient
Info	Observation only	Review if needed

Next: CLI Reference

All commands, flags, and output formats

Next: GitHub Action

Set up automated scanning in CI/CD

Next: Configuration

Customize HAVOC with .havoc.yml

Next: Analyzers

What each of the 9 analyzers checks