Excubia

Health checks for Laravel apps.

One command reads your lockfiles and tells you what is out of support, vulnerable, abandoned or blocking the next Laravel major, and in which order to fix it. Through Artisan it also checks the running app and its infrastructure. Open source under MIT, in CI and in production.

Get started View on GitHub

Terminal

$ vendor/bin/excubia checkExcubiaHealth checks for Laravel apps.3 critical · 2 high · 3 medium · 2 low Criticalphp  Security support ended on 2025-12-31.  Upgrade PHP to 8.5 (supported until 2029-12-31).laravel/framework  Security fixes ended on 2025-02-04.  Upgrade to Laravel 11; security fixes for your version end 2025-02-04. Highlaravel/framework  Known vulnerability PKSA-3r5d-mb8f-1qw9.  Update laravel/framework to ≥ fixed version (PKSA-3r5d-mb8f-1qw9).… Upgrade plan1. Update laravel/framework to ≥ fixed version (fixes 7 advisories).2. Upgrade PHP to 8.5 (supported until 2029-12-31).3. Upgrade to Laravel 11; security fixes for your version end 2025-02-04.

Real output of Excubia 1.0.0-rc.1 on the outdated Laravel 10 test project from its repository, shortened.

Over 40 checks, one report

Everything in your app that gets old or breaks

The lockfile checks run anywhere with vendor/bin/excubia, without booting your app. Through php artisan excubia:check Excubia also checks the booted app and the services it depends on. Every report ends with an ordered upgrade plan.

End of life: PHP, Laravel and Node: a warning before security support ends, a failure once it has.
Known vulnerabilities: Composer packages against the Packagist security advisories; npm, Yarn and pnpm packages against OSV.dev.
Package health: Abandoned, stale and outdated packages, dependency licenses, and the PHP extensions your packages require.
Next Laravel major: Direct dependencies whose latest release does not allow the next Laravel major yet.
App posture: Debug mode, app key, caches, pending migrations, session cookies, CORS, production drivers, log level, dev packages and .env.example.
Infrastructure: Database, cache, storage, disk space, queues and workers (Horizon included), scheduler, Redis memory and backups.
PHP in production: OPcache and php.ini settings as the web server sees them, not the CLI.
Laravel packages: Octane, Reverb, Cashier, Sanctum and Passport, checked only when they are installed.

Built for CI

Fail the build, not production

The standalone CLI needs only PHP and your composer.lock: no database, no .env, no install of your project. The output is made for people, scripts and AI agents.

Exit codes you can trust.: --fail-on stops the pipeline when a finding reaches the severity you choose, before a vulnerable release ships.
GitHub Action and SARIF.: qiick-io/excubia-core@v1 runs the check, writes the report to the job summary and sends the findings to GitHub code scanning.
Table, JSON, Markdown or SARIF.: A readable table in the terminal, versioned JSON for scripts and agents, Markdown for pull requests.
Config in the repo.: excubia.json sets thresholds, turns checks off and ignores a single advisory with a reason and an expiry date.

.github/workflows/excubia.yml

name: Excubia

on:
  pull_request:
  schedule:
    - cron: '0 6 * * 1'

permissions:
  contents: read
  security-events: write

jobs:
  excubia:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: qiick-io/excubia-core@v1
        with:
          fail-on: critical

In production

Monitoring on your own server

Install Excubia in the deployed app and it can report to excubia-app, the open-source dashboard you host yourself. Every part is off by default and switched on one by one in excubia.json.

Scheduled reports: excubia:push sends the full report from the scheduler and after each deploy, with deploy markers.
Runtime data: Aggregated and sampled: requests, jobs, queries and N+1 patterns, mail, cache, scheduled tasks, server resources and Laravel AI SDK usage.
Exceptions: Grouped and masked before they leave the app, including failed queued jobs and Artisan commands.
Health endpoint: An Oh Dear-compatible endpoint, plus minute-level health samples for alerts in excubia-app.
No payloads: Counts, timings and names; exception messages are masked. Never request bodies, query values or message contents.
Nothing goes to qiick: Data goes only to your own excubia-app, never to qiick or any third party. No telemetry.

excubia-app is open source too: the self-hosted dashboard for reports, runtime data, exceptions and alerts. qiick-io/excubia-app

Get started

Installed in one command

Excubia is a Composer package for PHP 8.2+. It reads composer.lock and your JavaScript lockfile; the Artisan commands need Laravel 12 or 13.

Install the package
As a dev dependency, for checks on your machine and in CI.
```
composer require --dev qiick/excubia-core
```
Run the checks
Never boots your app or runs project code. In a Laravel app, php artisan excubia:check adds the posture and infrastructure checks.
```
vendor/bin/excubia check
```
Go to production (optional)
Install it without --dev in the deployed app to push reports, send runtime data or serve the health endpoint.
```
php artisan excubia:push
```

Only names and versions leave your machine. The checks send package and runtime names and versions to the public data sources they query, nothing else: no file contents, .env values, source code, paths or hostnames. Private packages are never sent. No telemetry.

Why Excubia?

excŭbĭae: excŭbĭae, ārum, f.from excubo, “to lie out, keep watch”; “a lying out on guard, a watching, keeping watch”; concretely, “persons keeping watch, a guard”; Lewis & Short, A Latin Dictionary (1879)

In Latin, excubiae were the guards posted outside the camp or the house: the sentries who kept watch so everyone else could rest. Excubia does the same job for your Laravel app. It checks your lockfiles, dependencies and PHP and Node versions, so you hear about problems before your users do.

Roadmap

Release candidate today, 1.0 next

Excubia 1.0 is feature-complete and its public contracts are frozen: CLI options, report JSON, check IDs, exit codes, excubia.json and the push payloads. Until 1.0.0 only fixes land. Next, in this order:

01
Excubia 1.0
The same features and contracts as the release candidate, after a last round of fixes and feedback.
02
excubia-app 1.0
The stable self-hosted dashboard for reports, runtime data, exceptions and alerts.
03
1.1: request traces
Sampled request traces, opt-in like everything else.
04
1.1: logs and users
Log entries and pseudonymous user counts, each opt-in with its own personal-data level.

Follow the roadmap on GitHub

Health checks for Laravel apps.

Everything in your app that gets old or breaks

Fail the build, not production

Monitoring on your own server

Installed in one command

Install the package

Run the checks

Go to production (optional)

Why Excubia?

Release candidate today, 1.0 next

Excubia 1.0

excubia-app 1.0

1.1: request traces

1.1: logs and users