{"enrichment":{"faq":[{"a":"laravel-security covers foundational hardening across authentication, input validation, and vulnerability prevention. Key practices include using Laravel's built-in authentication (Sanctum for SPAs, Passport for OAuth), enforcing HTTPS in production, validating all user input via Form Requests, protecting against mass assignment with fillable/guarded, hashing passwords with bcrypt or Argon2, regenerating sessions after login, and implementing CSRF tokens on all state-changing requests. Enable security headers (CSP, X-Frame-Options) and audit log critical events for compliance.","q":"What are laravel security best practices I should follow?"},{"a":"laravel-security emphasizes that Eloquent's query builder and parameterized bindings protect against SQL injection by default. Always use Eloquent methods or query builder with placeholders (e.g., where('email', '=', $email)) rather than raw SQL. If you must use raw queries, bind parameters explicitly: DB::select('SELECT * FROM users WHERE id = ?', [$id]). Never concatenate user input directly into SQL strings. Validate and sanitize input before querying, and use Form Requests to enforce type and format rules.","q":"How do I prevent SQL injection in laravel eloquent queries?"},{"a":"laravel-security distinguishes these authentication tools: Sanctum is lightweight, designed for SPAs and mobile apps using token-based or cookie-based authentication with CSRF protection built in. Passport implements OAuth 2.0 and is suited for issuing tokens to third-party applications. Choose Sanctum for your own frontend; choose Passport when external clients need delegated access. Both integrate with Laravel's authorization gates and policies for role-based access control.","q":"What's the difference between Laravel Sanctum and Passport?"},{"a":"laravel-security recommends storing all sensitive data (database credentials, API keys, encryption keys) in your .env file, never in code. Use env() helpers in config files to load them. In production, set environment variables via your hosting platform (not .env files). Rotate secrets regularly, use strong encryption keys (php artisan key:generate), and never commit .env to version control. Audit who has access to secrets and use a secrets manager for teams. Validate that APP_DEBUG is false and APP_ENV is 'production' before deploying.","q":"How should I configure laravel environment variables and secrets?"},{"a":"laravel-security covers both: CSRF protection is automatic\u2014Laravel generates tokens for all POST/PUT/DELETE requests; include @csrf in forms or send X-CSRF-TOKEN header in AJAX. XSS prevention relies on escaping output: use {{ }} (Blade's double-brace syntax) to HTML-escape user data by default; only use {!! !!} for trusted content. Implement Content Security Policy headers to restrict script sources. Validate and sanitize all input, reject unexpected data types, and use Form Requests for centralized validation rules.","q":"How can I protect against CSRF and XSS attacks in Laravel?"},{"a":"laravel-security's deployment checklist includes: run php artisan config:cache and php artisan route:cache to optimize; set APP_DEBUG=false and APP_ENV=production; enforce HTTPS (set FORCE_HTTPS in config or use middleware); regenerate APP_KEY; disable unnecessary services; enable security headers (X-Frame-Options, X-Content-Type-Options); configure rate limiting on login and API endpoints; set up audit logging for security events; rotate database and API credentials; validate file upload restrictions; test CORS settings if serving an API; and monitor logs for suspicious activity.","q":"What steps should I take before deploying a Laravel app to production?"}],"shadow_tags":["token-auth","access-control","input-sanitization","secret-management","vulnerability-prevention","production-hardening","audit-trail","encryption-at-rest","rate-throttling","policy-enforcement"],"summary_rewrite":"This skill guides you through hardening Laravel applications against common vulnerabilities. Learn to configure Sanctum and Passport for secure authentication, implement role-based access control with gates and policies, enforce HTTPS, manage sessions safely, and validate passwords against compromised databases."},"files":[{"bytes":26452,"path":"skills/laravel-security/SKILL.md","sha256":"dccf356e6d8bc2da13409bb4afa5bbdce36ebcffa1927e71c8c27c2b17c25dd0","url":"https://skillfed.io/files/affaan-m/ECC/laravel-security/a2d85afd/SKILL.md"}],"id":"affaan-m/ECC/laravel-security","links":{"html":"https://skillfed.io/affaan-m/ECC/laravel-security","md":"https://skillfed.io/affaan-m/ECC/laravel-security.md","repo":"https://github.com/affaan-m/ECC"},"meta":{"agents_supported":[],"first_seen":"2026-07-28","forks":35692,"language":"JavaScript","last_updated":"2026-07-27","license":"MIT","name":"laravel-security","publisher":"affaan-m","stars":234207},"relations":{"similar":[{"id":"iSerter/laravel-claude-agents/laravel-authorization-patterns"},{"id":"rawveg/skillsforge-marketplace/laravel"},{"id":"AsyrafHussin/agent-skills/laravel-owasp-security"},{"id":"Pixel-Process-UG/superkit-agents/laravel-specialist"},{"id":"rawveg/skillsforge-marketplace/laravel-cashier-stripe"},{"id":"iSerter/laravel-claude-agents/laravel-middleware-patterns"},{"id":"noartem/skills/laravel-internationalization-and-translation"},{"id":"rawveg/skillsforge-marketplace/laravel-cashier-paddle"},{"id":"Jeffallan/claude-skills/laravel-specialist"},{"id":"thienanblog/awesome-ai-agent-skills/laravel-11-12-app-guidelines"}]},"slug":{"owner":"affaan-m","repo":"ECC","skill":"laravel-security"},"version":"a2d85afd"}