PHP Security Audit v2 Integration with DefectDojo
PHP Security Audit V2 is a set of PHP_CodeSniffer rules that performs static code analysis to identify security vulnerabilities and weaknesses in PHP code including SQL injection, cross-site scripting (XSS), command injection, file inclusion vulnerabilities, and insecure cryptographic practices across core PHP and framework-specific implementations such as Drupal. The tool integrates seamlessly into continuous integration pipelines through PHP_CodeSniffer with customizable rulesets and framework-specific security checks, enabling developers to detect security flaws that traditional object-oriented analysis tools might miss while also checking for CVE issues and security advisories related to CMS and framework components throughout the development lifecycle.
Data Granularity: What Gets Imported
The following fields are captured from PHP Security Audit v2 results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "PHP Security Audit v2",
"engagement": "<engagement-id>",
"file": "results.json"
}