Laravel Security: The Ten Things I Check Before Every Launch

Laravel is secure by default in the ways that matter most — CSRF tokens, prepared statements, hashed passwords. What catches people out is the configuration they changed themselves. This is the pass I run before any site goes live.

1. APP_DEBUG=false in Production

The single most common real-world leak. Debug mode prints your stack trace, environment variables and database credentials to anyone who triggers an error. Check it on the live server, not in your local .env.

2. Never Mass-Assign Request Input Blindly

// Dangerous: a crafted request can set is_admin
User::create($request->all());

// Safe: only what you validated
User::create($request->validated());

3. Authorization, Not Just Authentication

Logged in is not the same as allowed. Every route that loads a record by ID needs an ownership check, or any user can read any record by changing a number in the URL.

public function show(Invoice $invoice)
{
    $this->authorize('view', $invoice);
    return view('invoices.show', compact('invoice'));
}

4. Validate File Uploads by MIME, Not Extension

'avatar' => 'required|image|mimes:png,jpg,jpeg,webp|max:2048',

And store uploads outside the web root, served through a controller — which is exactly what a signed file route gives you.

5. Rate Limit Login and Any Public Form

Route::post('/login', ...)->middleware('throttle:5,1');

6. Force HTTPS

Redirect at the server level and set Strict-Transport-Security. A login form served over HTTP is a credential leak waiting for a coffee shop.

7. Escape Output — Know When You Are Not

{{ $value }} escapes. {!! $value !!} does not. The second one is a stored-XSS hole unless the content came from an admin-only rich text field you trust.

8. Lock Down the .env and storage Permissions

Your document root must be public/, never the project root. If someone can request /.env, everything else on this list is irrelevant.

9. Audit Your Dependencies

composer audit
npm audit

10. Rotate Anything That Leaked

If an API key was ever committed to git, it is compromised — even if you deleted it in a later commit. It is in the history. Rotate it.