Free WHMCS 9 readiness + security audit addon — looking for a few testers before I list it

[LiquidMonks]

I built a free addon called Examen because I couldn't find anything that answers "which of my modules will break on WHMCS 9?". It reads every module, hook and template file in your install and reports:

• PHP 8.x removals and deprecations (removed functions, ${var} interpolation, dynamic properties…), with file and line
• legacy WHMCS database helpers (select_query, full_query) and mysql_*
• Smarty tags WHMCS 9 / Smarty 4 no longer supports ({php}, {include_php}, {fetch}, $smarty.template_object, SmartyBC calls)
• ionCube / SourceGuardian / Zend Guard files it can't inspect, so you know which vendor to chase
• a per-module verdict (Ready / Needs review / Blocked / Encoded) and a 0–100 readiness score
• a short security pass: default admin folder, configuration.php permissions, attachments/templates_c inside the web root, leftover install/, admins without 2FA, API credentials with no IP allowlist, error display left on

It never executes the code it scans, makes no outbound connections, and never reads your database credentials. MIT licensed, 140+ unit tests on PHP 8.1–8.4.

I don't run a hosting company, so I have no production WHMCS to prove it against. If you're on 8.13 or 9.0 and willing to install it on a staging copy and send me the JSON export (or just a screenshot of the summary), I'll fix whatever it gets wrong and credit you in the changelog — and anyone who reports a real bug gets a free year of our first paid module when it launches. Happy to send the source first if you'd rather read it than run it.

Details: https://liquidmonks.com/whmcs-examen — reply here or email info@liquidmonks.com and I'll send the zip with its SHA-256 and a one-page test guide.

 

[slim]

You dont own a hosting co, dont have a WHMCS install - but wrote an app for it? 

It would be a fairly brave admin who took code from a one-time poster and ran it on their WHMCS install.

[bear]

Seems legit? 
From the site (emphasis mine):

Quote

 It makes no outbound connections. No telemetry, no licence check, no uploading your findings anywhere. Everything it produces stays in your database and on your disk.

It never reads your database credentials. configuration.php is checked for its file permissions only — the contents are not parsed and not stored. 

If it never reads the DB credentials, how exactly does it access it to store anything in it? Pass.

[slim]

Yeah - that’s what it says. Run it on your install - let us know.

[LiquidMonks]

@slim fair point, and it's exactly why I'm asking. I'm a developer, not a host: I build against the WHMCS developer docs and a test harness, which is why the post asks for staging installs instead of claiming it's proven. Please don't run it on a live install on my word. It's MIT, so the full source is yours to read before running anything; email info@liquidmonks.com and I'll send it.

@bear good catch, and that line on my site was badly worded; I've corrected it. Examen is an addon module, so it runs inside WHMCS and uses the database connection WHMCS has already opened (the same Capsule layer every addon uses). It never opens a connection of its own, so it never needs the credentials. It does read configuration.php in one narrow way: it tokenizes the file as text (never includes or executes it) and keeps only seven settings: the custom admin path, the attachments/downloads/templates_c/crons directories, $display_errors and $mysql_charset. The database host, user and password and the cc_encryption_hash are never extracted or stored, and a test in the suite fails if they ever are.

— Joe