Laravel Security

Use this when writing or reviewing code that touches user input, models, raw queries, Blade output, or authorization.

The normative security guidance below is grounded directly in Laravel's official documentation and Composer's security tooling, cited by ID in SOURCES.md (LARAVEL-ELOQUENT-01, LARAVEL-SECURITY-CSRF-01, LARAVEL-BLADE-XSS-01, LARAVEL-AUTHORIZATION-01, COMPOSER-AUDIT-01).

Dependency Advisories and Preflight

• Source-level analysis cannot catch vulnerabilities in installed framework and package dependencies. Run composer audit --locked during security preflight and verification to cross-reference locked dependencies against published security advisories (COMPOSER-AUDIT-01).
• Do not consider a security review or audit complete merely because application tests are green; test suites do not exercise or detect known upstream CVEs/GHSAs (such as CRLF injections in email validation, Livewire property-update RCEs, or unauthenticated upload flaws).
• Never ignore advisories via blanket --abandoned or --format suppression without explicit triage and tracking.
• When composer audit --locked reports an advisory, remediate it: upgrade the affected package to a patched release (composer update <vendor/package> --with-dependencies).
• If an immediate upgrade is blocked by upstream breaking changes or conflicting dependencies, record the advisory identifier (e.g. GHSA-...), root cause, compensating control, and remediation issue before proceeding.

Mass Assignment