Symfony Security Auditor

This auditor targets flaws that traditional PHP static analysis (PHPStan, Psalm), taint-flow SAST tools and dependency scanners cannot see, such as business-logic errors, missing authorization checks and multi-file attack chains. Its pipeline runs ingestion, mapping, then an audit stage where an Attacker agent hunts for vulnerabilities and a skeptical Reviewer agent culls false positives over up to three iterations, before emitting a validated report.

A dry-run mode scans files and estimates token usage and cost without calling a language model at all, useful for gauging cost before a full audit. While the pipeline runs, console mode narrates an attack-surface overview and each finding as the Attacker flags it, with color-coded severity in a terminal, or degrades to clean append-only lines in CI; the same report also renders as JSON, SARIF, HTML or Markdown. It runs as a standalone CLI with no footprint in the audited project, or as a Symfony bundle wired in through Flex, and is provider-agnostic through symfony/ai.