Laravel Security

This is a thorough security reference that covers the entire Laravel attack surface, from CSRF and mass assignment to rate limiting and signed URLs. You'll want it active when building auth flows, handling file uploads, or hardening APIs for production. It's opinionated in the right ways: encrypted casts for sensitive data, strict Form Request validation, policy middleware on routes, and practical rate limiting by both IP and email. The code examples are production-ready, not toy demos. If you're moving fast and need to know whether you've missed something obvious like SESSION_SECURE_COOKIE or wildcard CORS origins, this catches it.

install copies · 90 days. Times the install command was copied on this site in the last 90 days, bots filtered.: 5
skills.sh installs: 5.7K
GitHub stars: 229.1K
last updated: Jul 14, 2026

View on GitHub

Install

$ npx -y skills add affaan-m/everything-claude-code --skill laravel-security --agent claude-code

Installs into .claude/skills of the current project.

Files

Laravel Security Best Practices

Comprehensive security guidelines for Laravel applications to protect against common vulnerabilities.

When to Activate

Setting up Laravel authentication and authorization (Sanctum, Passport, Jetstream, Breeze)
Implementing user roles, permissions, and policies
Configuring production security settings and environment variables
Reviewing Laravel applications for security vulnerabilities
Deploying Laravel applications to production
Writing secure Eloquent queries and migrations

Production Configuration

Essential Production Settings

// config/app.php
'env' => env('APP_ENV', 'production'),
'debug' => (bool) env('APP_DEBUG', false), // CRITICAL: Never true in production
'key' => env('APP_KEY'), // Must be set: php artisan key:generate

// config/session.php
'secure' => env('SESSION_SECURE_COOKIE', true),
'http_only' => true,
'same_site' => 'lax',

// Verify APP_KEY is set at boot
// bootstrap/app.php or a service provider
if (empty(config('app.key'))) {
    throw new RuntimeException('APP_KEY is not set. Run: php artisan key:generate');
}