Menú
Security checklist before production deployment. Authentication, authorization, secrets, headers, dependencies. Use when preparing for deploy or conducting final review.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Basado en la clasificación ocupacional SOC
PHP Artisan CLI patterns including make commands, flags, custom commands, and AI-friendly usage.
Advanced Eloquent ORM patterns including relationships, eager loading, factories, and query optimization.
Laravel development best practices covering service providers, dependency injection, facades, and the Laravel Way.
Laravel Tinker best practices for debugging, testing ideas, and data exploration. When and how to use safely.
Laravel-native error handling patterns. Renderable exceptions, Livewire traits strategies, and user-facing notifications.
Integrate Anthropic Claude API with Laravel. HTTP client, message format, error handling. Use when calling Claude models from Laravel applications.
| name | pre-deploy-security |
| description | Security checklist before production deployment. Authentication, authorization, secrets, headers, dependencies. Use when preparing for deploy or conducting final review. |
Verify all security controls before going to production.
// Hardcoded secrets
$apiKey = 'sk_live_xxxxx';
$password = 'mypassword123';
// Environment variables
$apiKey = config('services.stripe.key');
.env (not committed).env.example has placeholder values onlyAPP_KEY is unique per environment# Search for potential hardcoded secrets
grep -rn "password\s*=" --include="*.php" app/
grep -rn "api_key\s*=" --include="*.php" app/
grep -rn "secret\s*=" --include="*.php" app/
Hash::make() (bcrypt default)RateLimiter)auth middleware on protected routes# Check routes without auth middleware
php artisan route:list --except-vendor | grep -v "auth"
$this->authorize() in controllers@can directives in Blade viewsFilamentUser implemented for admin access// Every controller action that modifies data should have:
$this->authorize('update', $post);
// or
Gate::authorize('admin-access');
$request->all() for mass assignment# Check for dangerous patterns
grep -rn '$request->all()' app/
grep -rn "DB::raw" app/
{{ }} for all user content{!! !!} only for trusted/sanitized HTML# Find raw output
grep -rn "{!!" resources/views/
SESSION_SECURE_COOKIE=true in productionsession.http_only=truesession.same_site=lax or strict'secure' => env('SESSION_SECURE_COOKIE', true),
'http_only' => true,
'same_site' => 'lax',
APP_URL=https://...)// app/Http/Middleware/SecurityHeaders.php
public function handle($request, Closure $next)
{
$response = $next($request);
$response->headers->set('X-Frame-Options', 'SAMEORIGIN');
$response->headers->set('X-Content-Type-Options', 'nosniff');
$response->headers->set('X-XSS-Protection', '1; mode=block');
$response->headers->set('Referrer-Policy', 'strict-origin-when-cross-origin');
return $response;
}
composer audit clean (no vulnerabilities)composer.lock committedcomposer audit
composer outdated --direct
APP_DEBUG=false in productionAPP_ENV=productionLOG_LEVEL=warning or higherenv() only used in config files# Check for env() in non-config files
grep -rn "env(" app/ --include="*.php"
RateLimiter::for('api', function (Request $request) {
return Limit::perMinute(60)->by($request->user()?->id ?: $request->ip());
});
RateLimiter::for('login', function (Request $request) {
return Limit::perMinute(5)->by($request->ip());
});
#!/bin/bash
echo "=== Pre-Deploy Security Check ==="
echo -e "\n1. Checking for hardcoded secrets..."
grep -rn "password\s*=\s*['\"]" --include="*.php" app/ config/
echo -e "\n2. Checking for raw output..."
grep -rn "{!!" resources/views/
echo -e "\n3. Checking for dangerous queries..."
grep -rn "DB::raw" app/
grep -rn '$request->all()' app/
echo -e "\n4. Checking dependencies..."
composer audit
echo -e "\n5. Checking env in non-config..."
grep -rn "env(" app/ --include="*.php"
echo -e "\n=== Done ==="
Before deploying, confirm:
composer audit cleanRemember: Security review is not optional. One vulnerability can compromise everything.