Laravel Security

Laravel Security Audit

Laravel makes development fast. We make sure it stays secure.

Sherlock Forensics provides Laravel security audits covering mass assignment, SQL injection via Eloquent misuse, debug mode exposure (APP_DEBUG=true), .env file leaks, Telescope in production, CSRF token issues, insecure file uploads and queue/job injection. Quick audits from $1,500 CAD. Standard penetration tests from $5,000 CAD.

Laravel is the most popular PHP framework for a reason. It ships with authentication scaffolding, an ORM, queue workers, broadcasting and a rich ecosystem of first-party packages. But every convenience feature is a potential attack surface when misconfigured. Mass assignment lets attackers modify fields you thought were protected. Eloquent's flexibility allows raw queries that bypass SQL injection protections. Debug mode exposes your entire environment to the internet. We audit Laravel applications daily and know exactly where the framework's guardrails fail.

Order a Quick Audit - $1,500 Scope a Full Pentest

What We Find

Laravel Vulnerabilities We Test For

01 - Assignment

Mass Assignment

Laravel's Eloquent ORM allows mass assignment of model attributes through create() and update() methods. When $fillable or $guarded properties are misconfigured, attackers can inject additional fields into requests to modify database columns they should not have access to. This includes escalating privileges by setting is_admin=true, changing ownership of records, modifying pricing fields and bypassing approval workflows. We test every model endpoint for mass assignment vulnerabilities by injecting unexpected fields and observing the database response.

02 - SQL

SQL Injection via Eloquent Misuse

Eloquent prevents SQL injection when used correctly, but developers frequently bypass its protections with raw queries, DB::raw(), whereRaw(), orderByRaw() and selectRaw() methods. User input concatenated into these raw expressions creates SQL injection vulnerabilities that Eloquent's parameter binding cannot prevent. We trace user input through controllers, form requests and query builders to identify raw query usage that accepts unsanitized data.

03 - Debug

Debug Mode in Production (APP_DEBUG=true)

Laravel's debug mode displays detailed error pages including full stack traces, environment variables, database credentials, API keys, mail server passwords and application configuration. When APP_DEBUG=true in production, any application error exposes this information to attackers. This is one of the most common and most dangerous Laravel misconfigurations we find. We trigger error conditions across your application to verify debug mode is properly disabled in all environments.

04 - ENV

.env Exposure

Laravel stores database credentials, API keys, mail passwords, encryption keys and service tokens in a .env file at the application root. If the web server is misconfigured or the document root points to the project root instead of the /public directory, the .env file becomes directly accessible via HTTP. Attackers routinely scan for /.env on every website they encounter. We test for .env accessibility through direct requests, path traversal, backup file patterns (.env.backup, .env.old) and web server misconfiguration.

05 - Telescope

Telescope in Production

Laravel Telescope is a debugging assistant that records every request, exception, database query, queued job, mail message and cache operation. When left enabled in production, it provides attackers with a complete view of your application internals including SQL queries with bound parameters, request payloads, user sessions and exception details. We check for accessible Telescope dashboards at /telescope and verify that debugging tools are disabled or properly gated in production environments.

06 - CSRF

CSRF Token Issues

Laravel includes CSRF protection by default through the VerifyCsrfToken middleware, but developers frequently exclude routes from CSRF protection for API endpoints, webhook receivers and AJAX calls. When CSRF exceptions are applied too broadly, state-changing actions become vulnerable to cross-site request forgery. We review your CSRF middleware exceptions, test excluded routes for forgeability and verify that API endpoints use proper token-based authentication instead of cookie-based sessions without CSRF protection.

07 - Upload

Insecure File Uploads

Laravel's file upload handling can be exploited when validation relies on client-provided MIME types rather than file content analysis. Attackers upload PHP shells disguised as images, exploit path traversal in upload filenames and access uploaded files directly when stored in public directories. We test your file upload endpoints for extension bypass, MIME type spoofing, path traversal, file size limits and whether uploaded files can be executed by the web server.

08 - Queue

Queue and Job Injection

Laravel's queue system deserializes job payloads to execute background tasks. When queue connections accept external input or when job classes can be manipulated, attackers can inject malicious serialized objects that execute arbitrary code during deserialization. This affects applications using database, Redis or SQS queue drivers with insufficient access controls. We test your queue configuration, job dispatch mechanisms and deserialization handling for injection vulnerabilities.

Our Approach

How We Audit Laravel Applications

Route and Middleware Mapping

We enumerate every route in your Laravel application including web routes, API routes, console routes and broadcast channels. We map middleware stacks to identify which routes have authentication, CSRF protection, rate limiting and authorization checks. Routes without proper middleware are our first testing targets.

Eloquent Model Review

We review every Eloquent model for mass assignment protection, examining $fillable, $guarded and $hidden properties. We test relationships for authorization bypass, inspect query scopes for injection points and verify that model factories and seeders do not leak into production. This model-level review catches vulnerabilities that endpoint testing alone misses.

Configuration and Environment Audit

We verify that debug mode is disabled, .env files are inaccessible, APP_KEY is properly set, session configuration is secure, CORS settings are restrictive and logging does not capture sensitive data. We also check for exposed Telescope, Horizon and Nova dashboards and verify that artisan commands are not accessible via the web.

Authentication and Authorization Testing

We test your authentication system including login, registration, password reset, email verification and session management. We verify that Gates, Policies and middleware enforce authorization consistently across all routes. For API authentication via Sanctum or Passport, we test token generation, scoping, revocation and expiration.

Pricing

Laravel Security Engagements

Quick Audit - $1,500 CAD
Focused security review covering mass assignment, .env exposure, debug mode, CSRF configuration and common Laravel vulnerabilities. Ideal for MVPs and early-stage applications. Delivered in 3-5 business days. Order online.
Standard Penetration Test - $5,000 CAD
Full penetration test for production Laravel applications covering all eight vulnerability categories, Eloquent injection, queue security, file upload testing, authentication and authorization across all routes. Order online.
Comprehensive Assessment - $12,000 CAD
Full-scope assessment including source code review, infrastructure testing, CI/CD pipeline review, server configuration audit and remediation support. For enterprise Laravel applications. Contact us to scope.

Frequently Asked Questions

Laravel Security FAQs

Is Laravel secure by default?
Laravel ships with solid security defaults including CSRF protection, parameterized queries through Eloquent, Blade template escaping and bcrypt password hashing. However, developers frequently override these defaults by disabling CSRF on routes, using raw database queries, leaving debug mode enabled and misconfiguring mass assignment protection. A Laravel security audit verifies that your application has not weakened the framework's built-in protections.
What are common Laravel vulnerabilities?
The most common Laravel vulnerabilities we discover include mass assignment on Eloquent models, SQL injection through raw query methods, APP_DEBUG=true exposing environment variables, .env files accessible via HTTP, Telescope dashboards open in production, CSRF exclusions applied too broadly, file upload validation relying on client MIME types and queue deserialization flaws. Most Laravel applications we test have at least two of these issues.
Can you audit a Laravel API?
Yes. We audit Laravel APIs built with Sanctum, Passport and custom authentication systems. We test token generation, scope enforcement, rate limiting, input validation, mass assignment on API endpoints, response data exposure and business logic flaws. Our auditors understand Laravel's API middleware stack and know where authorization gaps commonly occur.
How do I secure .env in Laravel?
Ensure your web server document root points to Laravel's /public directory, not the project root. Configure your web server to deny access to all dotfiles. Never commit .env to version control and add it to .gitignore. Use platform environment variables instead of .env files in production when your hosting supports it. Restrict file permissions to the application user. Rotate all secrets immediately if .env exposure is suspected.
Does my Laravel app need a pentest?
If your Laravel application handles user data, processes payments or runs in production with real customers, it needs a penetration test. Laravel's convenience features create security risks when misused, and the PHP ecosystem has a long history of exploitable vulnerabilities. Sherlock Forensics offers Laravel-specific security audits starting at $1,500 CAD with results in 3-5 business days.

Get Started

Secure your Laravel application before attackers find the gaps.

Quick audits from $1,500 CAD. Standard penetration tests from $5,000 CAD.

Order Online

Secure Your Laravel Application

Tell us about your Laravel stack, your deployment environment and your security concerns. We will recommend the right level of assessment for your application.

Call 604.229.1994
Phone
604.229.1994
Burnaby Office
Burnaby, BC, Canada
Coquitlam Office
Coquitlam, BC, Canada