laravel-audit-security

Laravel Security Audit

Audit the security boundaries of the Laravel application. Do not invent vulnerabilities merely because a pattern is uncommon. Require context and evidence.

List applicable rules first:

php artisan auditor:rules --domain=security --applicable

What to look for

• Authorization gaps: routes/controllers that mutate or expose resources without a policy, gate, or middleware.
• Insecure resource access: missing ownership checks on update/delete/show.
• Missing policies/gates where the app has clear resource ownership.
• Mass assignment risks: unguarded models or over-permissive $fillable combined with direct request input.
• Unsafe validation assumptions: trusting required/client-side checks, missing server-side validation on critical fields.
• Sensitive data exposure: secrets or personal data in responses, logs, exceptions, or dumps.
• Unsafe configuration usage: APP_DEBUG assumptions, hardcoded credentials, env values echoed.
• Dangerous file handling: unvalidated uploads, paths from user input, unsafe file reads.
• Unsafe URL/redirect handling: open redirects from user-controlled targets.
• Insecure authentication/authorization patterns: storing secrets in plaintext, weak session config, missing rate limits on auth.
• Secrets accidentally committed or exposed where detectable (.env committed, keys in source).
• Weak or missing CSRF protection: VerifyCsrfToken::except whitelists, removed/reordered CSRF middleware, forms or post endpoints missing the token.
• Unescaped output / XSS risk: Blade {!! !!}, ->get(), ->toHtml() rendering user-controlled or stored data.
• Raw SQL with user-controlled input: DB::raw, whereRaw, selectRaw, orderByRaw, or statement interpolating request input.
• Known vulnerable dependencies. dependencies.composer_audit is on by default. Use it for AUD-DEP-001 when available is true. If available is false, read reason or run composer audit --format=json yourself — do not treat an empty payload as “no advisories”. Set laravel-auditor.context.composer_audit to false only when you need to skip the shell-out.
• Queued jobs that serialize Eloquent models with hidden/sensitive attributes (AUD-QUE-002).