laravel-audit-security

name	laravel-audit-security
description	Audit a Laravel application's security boundaries: authorization, mass assignment, sensitive data, file/URL handling, CSRF, XSS, injection, and secrets. Use when auditing security or when asked to review security of a Laravel app.
metadata	{"agent":"any"}

Laravel Security Audit

Audit the security boundaries of the Laravel application. Do not invent vulnerabilities merely because a pattern is uncommon. Require context and evidence.

List applicable rules first:

php artisan auditor:rules --domain=security --applicable

What to look for

• Authorization gaps: routes/controllers that mutate or expose resources without a policy, gate, or middleware.
• Insecure resource access: missing ownership checks on update/delete/show.
• Missing policies/gates where the app has clear resource ownership.
• Mass assignment risks: unguarded models or over-permissive $fillable combined with direct request input.
• Unsafe validation assumptions: trusting required/client-side checks, missing server-side validation on critical fields.
• Sensitive data exposure: secrets or personal data in responses, logs, exceptions, or dumps.
• Unsafe configuration usage: APP_DEBUG assumptions, hardcoded credentials, env values echoed.
• Dangerous file handling: unvalidated uploads, paths from user input, unsafe file reads.
• Unsafe URL/redirect handling: open redirects from user-controlled targets.
• Insecure authentication/authorization patterns: storing secrets in plaintext, weak session config, missing rate limits on auth.
• Secrets accidentally committed or exposed where detectable (.env committed, keys in source).
• Weak or missing CSRF protection: VerifyCsrfToken::except whitelists, removed/reordered CSRF middleware, forms or post endpoints missing the token.
• Unescaped output / XSS risk: Blade {!! !!}, ->get(), ->toHtml() rendering user-controlled or stored data.
• Raw SQL with user-controlled input: DB::raw, whereRaw, selectRaw, orderByRaw, or statement interpolating request input.
• Known vulnerable dependencies. dependencies.composer_audit is on by default. Use it for AUD-DEP-001 when available is true. If available is false, read reason or run composer audit --format=json yourself — do not treat an empty payload as “no advisories”. Set laravel-auditor.context.composer_audit to false only when you need to skip the shell-out.
• Queued jobs that serialize Eloquent models with hidden/sensitive attributes (AUD-QUE-002).

When these packages are installed, also apply their packs (auditor:rules --applicable): Livewire (AUD-LW-*), Filament (AUD-FIL-*), Inertia (AUD-IN-*), Sanctum (AUD-API-*).

Evidence requirements

Every security finding needs at least:

• The specific route/controller/model file and line/range.
• The relevant middleware/policy/gate (or the absence of one).
• What the attacker-controlled input is, when applicable.

False positives

• Do not claim exploitability without sufficient evidence.
• A missing policy is only a finding when the resource is user-accessible or sensitive.
• Uncommon patterns are not automatically vulnerabilities.
• An empty composer_audit payload is not evidence that there are no advisories unless the check actually ran.

Severity guidance

• critical: directly exploitable, e.g. unauthenticated access to sensitive data or arbitrary code execution.
• high: requires a real but plausible precondition (e.g. any authenticated user).
• medium/low: defense-in-depth issues, configuration concerns, or low-exploitability risks.
• info: observations worth documenting without immediate risk.