PHP version
Paste php -v, phpinfo() output, or an X-Powered-By header to get a verdict for every PHP version it mentions.
php.ini, .user.ini or phpinfo HTML file, or click to choosecomposer.lock here, or click to chooseOnly package names and versions are read, in your browser. The list of names is sent to the public Packagist security-advisory API to look up known advisories. No file contents are uploaded.
Files are read locally with the File API and scanned in your browser. Binary files and files over 2 MB are skipped. Nothing is uploaded.
.env files, keypair JSON, or source files here, or click to chooseScans for exposed private keys, Solana keypairs and BIP39 seed phrases. Secrets are masked before anything is shown — only the public wallet address is displayed, so you know which wallet to rotate. Everything runs in your browser; nothing is uploaded.
Found something at or above high severity? Head to the fix playbooks and read the PHP2Shell advisory. For a full host scan, install the CLI.