Security

Run a focused security pass whenever work touches authentication, authorization, input handling, uploads, external integrations, payment-like flows, public APIs, or sensitive data.

Access Control

Every route/action that reads or mutates protected data needs authorization.

Use:

• route middleware for coarse access boundaries;
• Policies for model actions;
• Gates for cross-cutting checks;
• Form Request authorize() for request-input-dependent checks.

Test both allowed and denied paths.

Request Forgery And Rate Limits