Laravel Security

This is a comprehensive reference for locking down Laravel apps, covering everything from production config gotchas to authentication patterns. It walks through Sanctum token abilities, password hashing with argon2id, session regeneration to prevent fixation attacks, and proper policy/gate setup with real code examples. The production checklist alone is worth having open: APP_KEY validation, trusted proxy configuration for load balancers, HTTPS enforcement middleware. Especially useful when you're moving from local dev to production and need to catch security misconfigurations before they bite you. The Eloquent safety and XSS prevention sections would make this complete, but what's here covers the authentication and authorization stack thoroughly.

skills.sh installs: 6.6K
GitHub stars: 300.3K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add affaan-m/ecc --skill laravel-security --agent claude-code

Installs into .claude/skills of the current project.

Files

Laravel Security Best Practices

Comprehensive security guidelines for Laravel applications to protect against common vulnerabilities.

When to Activate

Setting up Laravel authentication and authorization (Sanctum, Passport, Jetstream, Breeze)
Implementing user roles, permissions, and policies
Configuring production security settings and environment variables
Reviewing Laravel applications for security vulnerabilities
Deploying Laravel applications to production
Writing secure Eloquent queries and migrations

Production Configuration

Essential Production Settings

// config/app.php
'env' => env('APP_ENV', 'production'),
'debug' => (bool) env('APP_DEBUG', false), // CRITICAL: Never true in production
'key' => env('APP_KEY'), // Must be set: php artisan key:generate

// config/session.php
'secure' => env('SESSION_SECURE_COOKIE', true),
'http_only' => true,
'same_site' => 'lax',

// Verify APP_KEY is set at boot
// bootstrap/app.php or a service provider
if (empty(config('app.key'))) {
    throw new RuntimeException('APP_KEY is not set. Run: php artisan key:generate');
}