Everything on Security.
15 articles tagged Security, sorted newest first.
PHP 8.6 Changes Your Session Defaults: What Breaks in a Laravel App
PHP 8.6 turns on session strict mode, HttpOnly and SameSite=Lax by default. Most Laravel apps shrug. Four specific integrations do not.
Laravel File Storage: The Complete Guide to Disks, Private Files, Direct Uploads and Signed URLs
Every Laravel app grows a file upload, and almost every one grows it the same wrong way: public disk, absolute URLs in the database, 300 MB videos through PHP, and a bucket full of objects nobody owns. This guide builds a private document library end to end on Laravel 13 — four disks, presigned browser uploads with a confirm step, three ways to serve a private file, validation that survives a spoofed MIME type, and the prune command nobody writes until the bill arrives.
Laravel Secrets in Production: The Complete Guide to env:encrypt, Secrets Manager and Rotation
Almost every Laravel deployment guide stops at "put it in .env and don't commit it". That is the absence of a secrets strategy. Here are the three patterns that actually work, and how to rotate a credential without taking the site down.
Laravel Sanctum in Production: API Tokens, Abilities and SPA Sessions
Sanctum is two unrelated authentication mechanisms sharing one package name, and almost every tutorial only covers half of one of them. This guide builds a real Orders API end to end: scoped tokens, an ability vocabulary that survives a year of growth, the tokenCan() hole nobody warns you about, expiry and pruning, full SPA cookie auth, per-token rate limiting, and Pest tests for all of it.
PHP Randomizer Engines: Choosing Between Secure, Seeded and Fast Randomness in Laravel
Two problems with one root cause: tokens that are guessable, and tests that are flaky. PHP's Random extension fixes both, once you pick the right engine.
Filament v5 Authorization: Policies, Roles and Permissions Complete Guide
A policy alone will not stop a user seeing every row in your table. Here are the four layers of Filament v5 authorization - panel access, policies, query scoping and field visibility - wired together and covered by tests.
Add Input and Output Guardrails to a Laravel AI SDK Agent
The Laravel AI SDK ships no moderation API, but it does give you one clean interception seam. Here is how I wrap an agent with input and output guardrails using agent middleware.
Redact Secrets from Stack Traces with PHP's #[\SensitiveParameter]
PHP prints every argument in a stack trace, so one thrown exception can dump a plaintext password into Sentry. One attribute fixes it.
Protect Livewire 4 Properties from Client-Side Tampering with #[Locked]
Every public Livewire property is sent to the browser and accepted back, so a user can rewrite it in DevTools. #[Locked] shuts that door for the properties that matter.
Laravel 13 PreventRequestForgery: Origin-Aware CSRF Protection in 5 Minutes
Laravel 13 renames VerifyCsrfToken to PreventRequestForgery and adds a Sec-Fetch-Site origin check on top of the token. Here's what changed, how to configure it, and the upgrade traps.
Stripe Identity Verification in Laravel: KYC Without a Compliance Vendor
Stripe Identity is right there in the dashboard you already use, costs $1.50 per US check, and rides on the same session + webhook pattern as Checkout.
Ditching Passwords: Setting Up Passkeys in Laravel 13
Passkeys are phishing-resistant, require no remembered secrets, and the browser handles the crypto. Here's how to add them to a Laravel 13 app in under an hour.
Fine-grained rate limiting on Laravel API routes
Slapping throttle:60,1 on every route treats your free-tier users and enterprise customers identically. Here's how to do it properly with named rate limiters.
Verifying Stripe webhook signatures in Laravel without Cashier
You don't need Laravel Cashier to verify Stripe webhook signatures. Here's the minimal setup using the Stripe PHP SDK directly in a controller.
How to audit PHP dependencies (practical guide)
How to audit PHP Composer dependencies for security, license and maintenance issues, with tools and a small script you can run today.