Laravel releases Moat, a Rust CLI for GitHub security audits

Laravel’s new Moat lands in the middle of a security mess that GitHub maintainers already know too well: controls are scattered, packages ship fast, and one missed setting can leave a repo exposed. Built in Rust by Laravel maintainer Nuno Maduro, the open-source CLI is a read-only auditor for GitHub user, organization, and repository security posture, not a fixer and not a dependency scanner.

That distinction matters. Moat does not change settings, remediate compromises, inspect composer.lock, or trace upstream packages. Instead, it walks through GitHub security controls across user, organization, repository, branch, release, and workflow scopes, then points out what is missing or misconfigured. Laravel said it checks 2FA, branch protection, signed commits, secret scanning, secret push protection, Dependabot alerts and security updates, immutable releases, fork pull request approval, workflow permissions, pinned actions, pull_request_target misuse, repository webhooks, direct collaborators, private vulnerability reporting, and whether a SECURITY.md file exists.

The pitch is simple because the problem is simple. GitHub gives maintainers a lot of levers, but they live on different settings pages and are easy to miss when a project has real traffic. Laravel also tied the tool to package publishing, noting that tagged releases flow from GitHub into Composer and then into applications that trust those packages. In other words, a weak repo setting can become a downstream problem very quickly.

Moat shipped as the PHP ecosystem was already dealing with fresh supply-chain pressure and other security warnings. That context made the launch feel less like a nice-to-have utility and more like a practical response to a live threat model. Security writers and Laravel voices have been pushing the same message from different angles: public-facing repository controls are the first line of defense, and they need to be checked before anything else.

The project’s current state also shows Laravel moving fast. The laravel/moat repository listed 12 releases and v0.1.12 as the latest release at capture time, while the commit history already showed a v1.0.4 bump, a sign of active churn rather than a one-off drop. Installation is straightforward too, with support for Homebrew or prebuilt binaries, and authentication through GITHUB_TOKEN, GH_TOKEN, or gh auth token.

That is the real appeal here. Moat does not promise magical supply-chain certainty. It gives maintainers a fast Rust command that surfaces the GitHub controls most likely to be forgotten, which is exactly the kind of sharp, usable tooling Rust keeps winning over when security teams want speed without ceremony.