Free Laravel Security Scanner

Common Laravel Vulnerabilities

Laravel is one of the most popular PHP frameworks, powering millions of applications. While it provides excellent security features, misconfiguration and developer mistakes create significant risks.

1. Exposed .env Files

The #1 Laravel vulnerability. If your web server serves the .env file, attackers get your database password, APP_KEY (used to decrypt all encrypted data), mail credentials, and every API key.

# Block .env access in Apache (.htaccess)
<Files ".env">
    Require all denied
</Files>

# Block .env access in Nginx
location ~ /\.env {
    deny all;
    return 404;
}

See our complete Exposed .env Files Fix Guide for all platforms.

2. Debug Mode in Production

When APP_DEBUG=true in production, Laravel's error handler (Ignition) displays:

• Full stack traces with file paths
• All environment variables (including secrets)
• Database queries and connection details
• Request headers and session data

# .env — PRODUCTION
APP_DEBUG=false
APP_ENV=production

# Also disable debug in config/app.php
'debug' => (bool) env('APP_DEBUG', false),

3. Mass Assignment

If $fillable or $guarded are not properly set on Eloquent models, attackers can modify any database column by adding extra fields to form submissions:

// VULNERABLE — No protection
class User extends Model {
    // Missing $fillable or $guarded!
}

// SECURE — Whitelist fillable fields
class User extends Model {
    protected $fillable = ['name', 'email', 'password'];
    // 'is_admin', 'role', etc. cannot be mass-assigned
}

4. SQL Injection via Raw Queries

Eloquent ORM prevents SQL injection by default, but raw queries bypass this protection:

// VULNERABLE — Raw query with user input
$users = DB::select("SELECT * FROM users WHERE name = '$name'");

// SECURE — Parameterized raw query
$users = DB::select('SELECT * FROM users WHERE name = ?', [$name]);

// SECURE — Eloquent (always parameterized)
$users = User::where('name', $name)->get();

Laravel Security Checklist

1. Block .env file access in web server configuration
2. Set APP_DEBUG=false and APP_ENV=production
3. Regenerate APP_KEY if it was ever exposed
4. Set $fillable on all Eloquent models
5. Never use raw SQL with user input — use Eloquent or parameterized queries
6. Keep Laravel and all packages updated (composer update)
7. Restrict access to Telescope, Horizon, and Nova dashboards
8. Configure security headers via middleware
9. Force HTTPS: set FORCE_HTTPS=true or use URL::forceScheme('https')
10. Set secure cookie flags: SESSION_SECURE_COOKIE=true
11. Set up SPF, DKIM, and DMARC for email security
12. Run composer audit regularly for dependency vulnerabilities

Related guides:

• How to Fix Exposed .env Files
• SQL Injection Prevention
• Security Headers Guide
• XSS Prevention Guide
• SPF/DKIM/DMARC Setup