· ReadyStack
Worked example
Real numbers from this tool, line by line.
Fourteen reachable lines in one 58-line Livewire component. That is the sample billing screen shipped with this extension, and it is the shape of the component Laravel agencies and product teams review every week.
Livewire 3 quietly redefines two PHP keywords. In plain PHP, public means "other PHP can reach this". In a Livewire component it means something larger: every public property is serialized into the page, round-tripped through the browser and sent back on the next request, and every public method can be invoked from the browser as $wire.methodName(). The template does not have to mention either one. public function deleteInvoice() is an endpoint. public $amountDue is a form field.
That is the gap AI assistants fall into. An assistant asked for "a Livewire component that approves an invoice" writes idiomatic PHP: public properties for the state, public methods for the actions, authorization left for later. The result compiles, renders, passes type checks and ships.
Run the audit over the sample component and ten rules produce fourteen findings: eleven high, two medium, one low. public $invoiceId at line 14 has no #[Locked], so the browser chooses which invoice the next method touches. public $apiToken at line 17 is serialized into the HTML snapshot and readable in view-source. mount() at line 23 looks a record up and the class never calls authorize(), Gate::, can() or abort_unless() — so any signed-in visitor can mount another tenant's invoice. approve(), deleteInvoice() and saveReceipt() at lines 29, 34 and 39 are three callable endpoints on that same unguarded class. Line 31 writes $this->only(...) straight into the row. Line 41 stores an upload from a class with no validation rule. Line 51 prints {!! $invoiceNotes !!} unescaped, and line 52 includes a template whose name comes from a variable.
The fixed twin of that file — same class, 65 lines, #[Locked] on the state, authorize() in mount() and in each action, a validate() call before store(), {{ }} instead of {!! !!} — returns zero.
Nothing here needs a novel analysis. It needs a rule set that knows what public means inside Livewire, which is exactly what a general PHP linter does not carry. PHPStan, Psalm and Larastan model the call graph as PHP defines it; the browser is not a caller in that graph. A chatbot can explain the round-trip in a paragraph but cannot walk the files in your repository.
The clock matters as much as the finding. The moment an unguarded public method hands one tenant another tenant's record, that is a personal-data breach, and GDPR Article 33 gives the controller seventy-two hours from awareness to notify the supervisory authority. The finding you did not run is the one that starts that timer without telling you.
The free tier is the whole job for one file: open any .php or .blade.php file, run the check, and every finding from all ten rules comes back with its line number and its fix. No watermark, no counter, nothing held behind a key. The same engine runs as a single web page, so a reviewer with no editor can paste a component in and read the same result.
What the full version adds is a different axis, not a bigger slice of the same one: it sweeps every PHP and Blade file in the workspace in one run and exports a dated Markdown or JSON audit — the artefact you attach to a release, hand to a client, or fail a build on. Yardstick: a single-application web penetration test typically starts around $2,000.
15 seconds — what it actually does
Questions people ask
What does Livewire Client Surface Audit actually do?
It reads the PHP or Blade file you have open and marks every line the visitor's browser can reach: public methods callable as $wire.name(), public properties the browser round-trips and can rewrite, secrets serialized into the page HTML, unvalidated uploads, unescaped Blade echoes. Ten rules, and each finding carries the line number and the one-line fix.
Who is this for?
Laravel teams shipping Livewire 3 components: agencies handing an app to a client, product teams reviewing components an AI assistant wrote, and contractors answering a customer security questionnaire. One unguarded public method that hands over another tenant's record is a breach with a 72-hour GDPR Article 33 reporting clock attached to it.
Why will PHPStan or a chatbot not do this?
PHPStan, Psalm and Larastan model public the way PHP defines it, as reachable from other PHP. Livewire redefines public as reachable from the visitor's browser, and no general PHP linter ships a rule for that round-trip. A chatbot can explain the idea but cannot walk your files. The sample component here returns fourteen findings across fifty-eight lines.
What is free and what is paid?
Free covers one file completely: open any .php or .blade.php file, run the check, and you get all ten rules, every finding, the line number and the fix. No watermark, no counter, no locked result. The full version changes the axis instead: it sweeps the whole workspace at once and exports a dated Markdown or JSON audit.
What does the alternative cost?
A single-application web penetration test typically starts around $2,000, and a security questionnaire answered by a senior Laravel contractor costs a day of that contractor's rate. The full version is $29 once, one licence key per person or team seat,. The free tier stays free and needs no key at all.
Why not just ask ChatGPT or another AI chat?
A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. Livewire Client Surface Audit checks the file you open against 10 rules from a rule set dated 2026-09-20, and points at the exact line with the fix. For a filing, an audit or a client you need that dated result on your own files.
Ask about this tool
One question, answered by the person who built it. Your email only if you want the answer sent.