Skip to content
1.0 release candidateSee the roadmap

Excubia

Health checks for Laravel apps.

One command reads your lockfiles and tells you what is out of support, vulnerable, abandoned or blocking the next Laravel major, and in which order to fix it. Through Artisan it also checks the running app and its infrastructure. Open source under MIT, in CI and in production.

Get startedView on GitHub
Terminal
$ vendor/bin/excubia check
Excubia
Health checks for Laravel apps.
3 critical · 2 high · 3 medium · 2 low

Critical
php
  Security support ended on 2025-12-31.
  Upgrade PHP to 8.5 (supported until 2029-12-31).
laravel/framework
  Security fixes ended on 2025-02-04.
  Upgrade to Laravel 11; security fixes for your version end 2025-02-04.

High
laravel/framework
  Known vulnerability PKSA-3r5d-mb8f-1qw9.
  Update laravel/framework to ≥ fixed version (PKSA-3r5d-mb8f-1qw9).
…

Upgrade plan
1. Update laravel/framework to ≥ fixed version (fixes 7 advisories).
2. Upgrade PHP to 8.5 (supported until 2029-12-31).
3. Upgrade to Laravel 11; security fixes for your version end 2025-02-04.
Real output of Excubia 1.0.0-rc.1 on the outdated Laravel 10 test project from its repository, shortened.

Over 40 checks, one report

Everything in your app that gets old or breaks

The lockfile checks run anywhere with vendor/bin/excubia, without booting your app. Through php artisan excubia:check Excubia also checks the booted app and the services it depends on. Every report ends with an ordered upgrade plan.

End of life
PHP, Laravel and Node: a warning before security support ends, a failure once it has.
Known vulnerabilities
Composer packages against the Packagist security advisories; npm, Yarn and pnpm packages against OSV.dev.
Package health
Abandoned, stale and outdated packages, dependency licenses, and the PHP extensions your packages require.
Next Laravel major
Direct dependencies whose latest release does not allow the next Laravel major yet.
App posture
Debug mode, app key, caches, pending migrations, session cookies, CORS, production drivers, log level, dev packages and .env.example.
Infrastructure
Database, cache, storage, disk space, queues and workers (Horizon included), scheduler, Redis memory and backups.
PHP in production
OPcache and php.ini settings as the web server sees them, not the CLI.
Laravel packages
Octane, Reverb, Cashier, Sanctum and Passport, checked only when they are installed.

Built for CI

Fail the build, not production

The standalone CLI needs only PHP and your composer.lock: no database, no .env, no install of your project. The output is made for people, scripts and AI agents.

Exit codes you can trust.
--fail-on stops the pipeline when a finding reaches the severity you choose, before a vulnerable release ships.
GitHub Action and SARIF.
qiick-io/excubia-core@v1 runs the check, writes the report to the job summary and sends the findings to GitHub code scanning.
Table, JSON, Markdown or SARIF.
A readable table in the terminal, versioned JSON for scripts and agents, Markdown for pull requests.
Config in the repo.
excubia.json sets thresholds, turns checks off and ignores a single advisory with a reason and an expiry date.
.github/workflows/excubia.yml
name: Excubia

on:
  pull_request:
  schedule:
    - cron: '0 6 * * 1'

permissions:
  contents: read
  security-events: write

jobs:
  excubia:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: qiick-io/excubia-core@v1
        with:
          fail-on: critical

In production

Monitoring on your own server

Install Excubia in the deployed app and it can report to excubia-app, the open-source dashboard you host yourself. Every part is off by default and switched on one by one in excubia.json.

Scheduled reports
excubia:push sends the full report from the scheduler and after each deploy, with deploy markers.
Runtime data
Aggregated and sampled: requests, jobs, queries and N+1 patterns, mail, cache, scheduled tasks, server resources and Laravel AI SDK usage.
Exceptions
Grouped and masked before they leave the app, including failed queued jobs and Artisan commands.
Health endpoint
An Oh Dear-compatible endpoint, plus minute-level health samples for alerts in excubia-app.
No payloads
Counts, timings and names; exception messages are masked. Never request bodies, query values or message contents.
Nothing goes to Qiick
Data goes only to your own excubia-app, never to Qiick or any third party. No telemetry.

excubia-app is open source too: the self-hosted dashboard for reports, runtime data, exceptions and alerts. qiick-io/excubia-app

Get started

Installed in one command

Excubia is a Composer package for PHP 8.2+. It reads composer.lock and your JavaScript lockfile; the Artisan commands need Laravel 12 or 13.

  1. Install the package

    As a dev dependency, for checks on your machine and in CI.

    composer require --dev qiick/excubia-core

  2. Run the checks

    Never boots your app or runs project code. In a Laravel app, php artisan excubia:check adds the posture and infrastructure checks.

    vendor/bin/excubia check

  3. Go to production (optional)

    Install it without --dev in the deployed app to push reports, send runtime data or serve the health endpoint.

    php artisan excubia:push

Only names and versions leave your machine. The checks send package and runtime names and versions to the public data sources they query, nothing else: no file contents, .env values, source code, paths or hostnames. Private packages are never sent. No telemetry.

Why Excubia?

excŭbĭae
excŭbĭae, ārum, f.from excubo, “to lie out, keep watch”
“a lying out on guard, a watching, keeping watch”; concretely, “persons keeping watch, a guard”
Lewis & Short, A Latin Dictionary (1879)

In Latin, excubiae were the guards posted outside the camp or the house: the sentries who kept watch so everyone else could rest. Excubia does the same job for your Laravel app. It checks your lockfiles, dependencies and PHP and Node versions, so you hear about problems before your users do.

Roadmap

Release candidate today, 1.0 next

Excubia 1.0 is feature-complete and its public contracts are frozen: CLI options, report JSON, check IDs, exit codes, excubia.json and the push payloads. Until 1.0.0 only fixes land. Next, in this order:

  1. 01

    Excubia 1.0

    The same features and contracts as the release candidate, after a last round of fixes and feedback.

  2. 02

    excubia-app 1.0

    The stable self-hosted dashboard for reports, runtime data, exceptions and alerts.

  3. 03

    1.1: request traces

    Sampled request traces, opt-in like everything else.

  4. 04

    1.1: logs and users

    Log entries and pseudonymous user counts, each opt-in with its own personal-data level.

Follow the roadmap on GitHub