laravel-security
Laravel security best practices for authn/authz, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment.
npx skills add mturac/everything-openai-codex --skill laravel-security --agent codex
Same command for any agent — swap --agent for claude-code, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Laravel Security Best Practices Comprehensive security guidance for Laravel applications to protect against common vulnerabilities. ## When to Activate - Adding authentication or authorization - Handling user input and file uploads - Building new API endpoints - Managing secrets and environment settings - Hardening production deployments ## How It Works - Middleware provides baseline protections (CSRF via `VerifyCsrfToken`, security headers via `SecurityHeaders`). - Guards and policies enforce access control (`auth:sanctum`, `$this->authorize`, policy middleware). - Form Requests validate and shape input (`UploadInvoiceRequest`) before it reaches services. - Rate limiting adds abuse protection (`RateLimiter::for('login')`) alongside auth controls. - Data safety comes from encrypted casts, mass-assignment guards, and signed routes (`URL::temporarySignedRoute` + `signed` middleware). ## Core Security Settings - `APP_DEBUG=false` in production - `APP_KEY` must be set and rotated on compromise - Set `SESSION_SECURE_COOKIE=true` and `SESSION_SAME_SITE=lax` (or `strict` for sensitive apps) - Configure trusted proxies for correct HTTPS detection ## Session and Cookie Hardening - Set `SE
- When to Activate
- How It Works
- Core Security Settings
- Session and Cookie Hardening
- Authentication and Tokens
- Password Security
- Authorization: Policies and Gates
- Validation and Data Sanitization
- Mass Assignment Protection
- SQL Injection Prevention
- XSS Prevention
- CSRF Protection
- File Upload Safety
- Rate Limiting
What does the laravel-security skill do?
Laravel security best practices for authn/authz, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment.
How do I install it?
Run `npx skills add mturac/everything-openai-codex --skill laravel-security --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From mturac/everything-openai-codex, a repository with 84 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.