Laravel Security

Step 0 — Detect

rg -n "laravel/framework" -g 'composer.json' ; ls artisan app routes config 2>/dev/null

Record Laravel version (composer.json/lock), PHP version, and whether Sanctum/Passport/Fortify are in use.

Step 1 — Config & env (the Laravel RCE chain)

git ls-files | rg -i '(^|/)\.env($|\.)'
rg -n "APP_DEBUG\s*=\s*true|APP_ENV\s*=\s*production" -g '.env*'
rg -n "APP_KEY" -g '.env*' -g 'config/app.php' | head -3

• Committed .env / APP_KEY → Critical: leaked APP_KEY lets attackers forge encrypted cookies; with older serializable-cookie sessions or queued-job payloads this chains to RCE via PHP deserialization gadgets. Fix: rotate APP_KEY (php artisan key:generate), purge from history, treat all session data as compromised.
• APP_DEBUG=true with APP_ENV=production → High (stack traces; historically .env disclosure via error pages).
• config/session.php: secure/http_only false → Medium; same_site null → Medium.

Step 2 — Mass assignment (privilege escalation)

rg -n "fillable|guarded" app/Models/ | head
rg -n "::create\(|::update\(|forceFill|unguard" app/ routes/ | head -20
rg -n "Model::unguard\(true\)|ShouldAutoSize" app/Providers/ 2>/dev/null

For each model feeding ::create/update with request data:

• No $fillable/$guarded (both default open-ish; $guarded=[] explicitly wide) + $request->all()/$request->validated() including role-ish columns (is_admin, role, user_id, price) → Critical (attacker self-promotes by adding is_admin=1 to the POST).
• Model::unguard() globally → same finding, repo-wide.
• Fix: explicit $fillable allowlist + $request->only([...]) / typed FormRequests.

Step 3 — SQL injection

rg -n "DB::raw|whereRaw|orderByRaw|selectRaw|havingRaw|DB::select\(|DB::statement\(" app/ routes/

• Raw expressions with concatenation/interpolation of request data → Critical
• Query builder with bindings (where('name', $req->name)) → safe, note as positive
• orderBy($request->input('sort')) — column names can't be bound; must be allowlisted → Medium/High

Step 4 — Blade XSS

rg -n '\{!!' -g '*.blade.php' .
rg -n '\{!!' -g '*.blade.php' . | wc -l   # census FIRST: know the full inventory size

Census, don't sample. Glob to *.blade.php — the bare pattern also matches React/TSX aria-invalid={!!…} noise that crowds out real hits. Run wc -l before reading: every raw echo in the inventory gets an explicit disposition (verified-safe / finding / not-assessed). head-truncating this list is how review-moderation XSS ships to production. For repos >50 hits, triage by author privilege first (below), but never leave the tail unexamined.

Every {!! !!} with a variable that traces to user input is a finding — then triage by privilege direction, which sets the severity:

Blade's {{ }} escapes; {!! !!} exists only to bypass. nl2br() is NOT an escape — {!! nl2br($x) !!} is a raw echo. Check {{ $x }} + |raw? (Blade has no |raw; Twig confusion = false positive).

Step 5 — CSRF

rg -n "except" app/Http/Middleware/VerifyCsrfToken.php bootstrap/app.php 2>/dev/null
rg -n "withoutMiddleware|WithoutMiddleware" app/ routes/

• $except with '*' → High; with real routes → verify the handler is genuinely webhook-only (state-changing → High)
• Laravel 11+: validateCsrfTokens(except: [...)) in bootstrap/app.php

Step 6 — Authorization

rg -n "middleware\(" routes/ | head -20
rg -n "Gate::before|Gate::define|policy|authorize\(" app/ | head -20

• State-changing/admin routes without auth middleware → High
• Gate::before(fn () => true) unconditional allow → Critical
• Policies existing but not auto-discovered + no authorize() calls in controllers → flag as "authz unmapped" (Medium, needs verification)

Step 7 — Files, uploads, misc

rg -n "response\(\)->download|Storage::(download|get|put)|\->store\(" app/
rg -n "debugbar|telescope|ignition" composer.json composer.lock 2>/dev/null
rg -n "eval\(|unserialize\(|assert\(" app/

• download(storage_path('app/' . $request->input(...))) → path traversal, High
• Uploads without validated() mimes/size rules stored on public disk → Medium/High
• debugbar/telescope in require (not require-dev) → Medium
• unserialize on user data → Critical (with APP_KEY leak = full RCE chain, cross-reference Step 1)

Step 8 — Feature flags & outbound-email amplification

Plan-constrained tenants are authenticated ADMINS whose capability should be plan-gated — menu-level hiding is cosmetic. (Incident class, 2026-09-23 user report: one trial tenant blasted 1200+ emails in ~2 minutes via an ungated compose route + global-default import flag.) The attacker persona is an admin the PLAN should stop, not one auth should stop.

# flag census: every define + its default, then every use site
rg -n "Feature::(define|active|for)" app/ modules/ config/
# which routes actually carry the feature middleware
rg -n "feature:" routes/ modules/ routes/ app/ 2>/dev/null
# email-triggering endpoints and their throttles
rg -n "Route::(get|post)" routes/ modules/ routes/ | rg -i "send-|verif|subscribe|reset"
rg -n "throttle:" routes/ modules/ routes/
# blast fan-out: jobs that load unbounded sets and send per row
rg -n "::query\(\)->get\(\)|::all\(\)" app/ modules/
rg -n "Mail::to\(|Mail::send\(" app/ modules/
# pennant store + whether deploys purge stored values
rg -n "'store'" config/pennant.php
rg -n "pennant:purge" deploy/ scripts/

• Flag gated in UI only — flag checked in Blade/menu or inside the JOB, but its routes lack ->middleware('feature:...') → Critical: the route is the enforcement point; the in-job check is defense-in-depth, not the gate
• Feature::define('<capability>', true) for import/email/SMS flags defaulting true globally → High (plan gating absent; per-plan closures are the safe shape)
• Pennant staleness — database store + no pennant:purge in any deploy script → Medium: reverting a default does NOT clear stored per-scope values; any scope resolved during a true-default window keeps true until purged
• Blast amplification — one request → N outbound emails: a dispatched job loads Model::query()->get() unbounded and sends per row, no cap, no route throttle: → Critical (one request = whole mailing list; attacker-controlled subject/body = phishing from your own domain). Flow class F9, ../flow-security/SKILL.md
• Public email-triggering endpoints — send-verification-link-style GET (side effect on a GET!) or subscribe POST, public, unthrottled, no captcha → Critical (enumerating IDs over a public sender = mail bomb with zero auth)
• $request->all() into a compose DTO (free-text subject/body) → High (mass assignment + platform-domain phishing)
• Safe shapes: feature: middleware on the route AND Feature::active re-checked in the job; ->limit() recipient cap + per-tenant daily quota consumed ATOMICALLY inside the job (queued jobs outlive flag flips — the quota check must not be check-then-act on the HTTP side); POST + signed URL + throttle: for verification links; FormRequest for compose; verified-recipients-only targeting

Reporting

Severity table above. Fixes are usually short — give exact code (protected $fillable = ['name','email'];, whereRaw('name = ?', [$name])). Cross-reference dependency CVEs via ../dependency-vulns/SKILL.md (composer.lock).