laravel-security
Laravel security best practices — authentication, authorization, Eloquent safety, CSRF, XSS prevention, API security, and secure deployment configurations. Use when reviewing Laravel auth, Eloquent safety, CSRF, XSS, API security, or deployment configuration.
- Kind
- Skill
- Works with
- Claude Code, Codex
- Languages
- PHP
- Source
- affaan-m/ECC @ d3b8a3e90890
- Path
- skills/laravel-security/SKILL.md
- License
- MIT
- Jobs
- Guardrails, Review
InstallCopy it from the source repository, or sign in and let the assistant adapt it for your project.
# Laravel Security Best Practices
Comprehensive security guidelines for Laravel applications to protect against common vulnerabilities.
## When to Activate
- Setting up Laravel authentication and authorization (Sanctum, Passport, Jetstream, Breeze)
- Implementing user roles, permissions, and policies
- Configuring production security settings and environment variables
- Reviewing Laravel applications for security vulnerabilities
- Deploying Laravel applications to production
- Writing secure Eloquent queries and migrations
## Production Configuration
### Essential Production Settings
```php
// config/app.php
'env' => env('APP_ENV', 'production'),
'debug' => (bool) env('APP_DEBUG', false), // CRITICAL: Never true in production
'key' => env('APP_KEY'), // Must be set: php artisan key:generate
// config/session.php
'secure' => env('SESSION_SECURE_COOKIE', true),
'http_only' => true,
'same_site' => 'lax',
// Verify APP_KEY is set at boot
// bootstrap/app.php or a service provider
if (empty(config('app.key'))) {
throw new RuntimeException('APP_KEY is not set. Run: php artisan key:generate');
}
```
### Environment File Security
```bash
…