Hostile Adversarial Vulnerability & Oversight Check
Framework-aware security scanning that finds real vulnerabilities — not generic noise. Understands your Laravel policies, Gates, and Eloquent scoping. Runs on every PR.
Generic tools flag hundreds of phantom issues. HAVOC understands your framework's security model and finds gaps that actually matter.
Understands Laravel policies, Gates, middleware, and Eloquent scoping. Not just regex — real AST analysis of your framework's security model.
Track what % of your endpoints have security checks — like code coverage, but for auth. Trending over time so you can see progress.
Auto-generates PHPUnit tests that prove vulnerabilities exist. These tests become your regression suite — not just findings.
Inline findings on the exact lines that need attention, just like Codecov. Coverage delta in every PR description.
LLM-powered analysis reduces false positives by 80%+. Every finding is reviewed in context before it reaches your team.
One-click fix generation for common security patterns. HAVOC opens the PR, you review and merge.
One command gets you scanning. Works with npm, Composer, or as a standalone binary. Zero config required to get your first results.
HAVOC auto-detects your framework and runs 9 specialized analyzers. Results in seconds, not hours. Authorization coverage calculated across every controller method.
Diff-aware in CI — only scans changed files in PRs, but reports overall coverage from the last full scan.
Each finding includes an explanation, a code fix, and links to OWASP/CWE documentation. Auto-fix PRs for common patterns. Exploit tests as regression suite.
View sample finding →Missing authorization gate
TransactionController.php:142
+ $this->authorize('bulkConfirm', $project);
HAVOC posts inline comments on the exact lines with issues — just like Codecov. Your team sees security findings in context, not buried in a separate dashboard.
No credit card required to start. Upgrade when you need the cloud dashboard and advanced features.
Perfect for solo developers and open-source projects.
For growing teams who need visibility and history.
For teams shipping fast who need full automation.
Self-hosted, SSO, SLA, and dedicated security support.
Snyk and Semgrep are generic tools — they treat all code the same. HAVOC is built around your framework's security model. It knows that a missing $this->authorize() in a Laravel controller is a real vulnerability, not a suggestion. This framework-awareness means fewer false positives and more real findings.
No. Code is cloned for scanning and deleted immediately after. We store scan results (findings, coverage metrics, metadata) — never your source code. Enterprise customers can use the self-hosted scanner, which means your code never leaves your network.
HAVOC v1.0 has deep support for Laravel (PHP). This includes all 9 analyzers: authorization coverage, mass assignment, XSS surfaces, SQL injection, IDOR, policy parity, privilege escalation, state machine bypass, and credential exposure. Rails and Django analyzers are on the roadmap for v2.0 and v3.0.
HAVOC parses every public controller method and checks whether it has an authorization check — $this->authorize(), Gate::, can(), or middleware on the route. It reports a percentage (e.g. "94.2% of 147 methods") and which specific methods are missing checks. Think of it like code coverage, but for security.
Yes! The CLI and GitHub Action are completely free and don't require a HAVOC Cloud account. You get terminal output, PR comments, and commit status checks. The cloud dashboard adds history, trends, team features, and AI-powered enhancements on top.
All paid plan features are available free for 14 days — no credit card required. After the trial, you can stay on the Free tier or subscribe to a paid plan. We don't lock you out or hold your scan history hostage.
🔴 HAVOC Security Report
2 new findings in feature/bulk-transactions
Authorization Coverage