A Laravel security review is not a scan you run once. It is a walk through the application’s real decisions: how it authenticates people, how it decides what they are allowed to do, how it talks to the database, and what it does when something goes wrong. This page is that walk, written down. It gathers the guides I have published from doing this work, so you can review your own application against the same checklist I use.
Laravel is secure by default, which is exactly why the interesting failures happen at the edges: the config that got changed for a deadline, the one raw query, the upload that trusts a filename. The sections below are the areas I look at, in the order I look at them.
What a Laravel security review covers
- Environment and configuration: debug mode, the app key, secrets, and what an error page reveals to a stranger.
- Authentication and authorization: not just whether login works, but whether one user can reach another user’s data. This is where most real bugs live. See Securing Authentication and Authorization in Laravel.
- The database layer: Eloquent keeps you safe until a raw query or an open model reopens SQL injection and mass assignment.
- Input validation and output escaping: the allow-list of what the app accepts, and Blade’s escaping of what it renders.
- File uploads: the classic path from user input to code execution.
- Dependencies: most breaches enter through an unpatched package, not custom code.
- AI-generated code: assistants write fluent Laravel that quietly steps around the framework’s protections, so the review matters more, not less. See Laravel Security in Times of AI Code Generation.
- Logging and monitoring: you cannot respond to what you never recorded.
Guides and articles
Start here. Each guide is something I use on real reviews, and they cross-link so you can go as deep as you need:
- A Laravel Security Checklist for Production: the actionable spine, the pass I run before any Laravel app goes live.
- Securing Authentication and Authorization in Laravel: Sanctum, passwords, throttling, and closing broken access control with Gates and Policies.
- Preventing the OWASP Top 10 in Laravel: the industry risk list mapped to concrete Laravel practice.
- Laravel Security in Times of AI Code Generation: reviewing the Laravel code your AI assistant writes, with the discipline from the book You Are the Quality Control.
- 7 Laravel Features to Enhance the Security of Your Application: the framework’s built-in protections and how to use them well.
New guides land here as they are published.
Foundations
Laravel’s protections rest on ideas that predate the framework. These older notes explain the reasoning underneath:
- Why do we use a token concept in PHP?: sessions, cookies and how tokens prevent request forgery.
- Things you should know about file upload handling in PHP: the fundamentals Laravel’s upload validation builds on.
- A Note on Security in PHP: why input data is the thing you can never trust.
Get a second pair of eyes
A review is most useful before a launch or after a period of fast growth, when the shortcuts have piled up. If you would like me to look over a Laravel application with you, get in touch and tell me a little about the app and what is worrying you.