Laravel Security Review
A structured look at how the application can be abused or accidentally exposed — from the codebase, not a sales badge.
A review is not a certification
There is no honest “Laravel secure badge” from a questionnaire. A security review reads the code. OWASP’s application notes remain useful context: OWASP Top 10.
If you also need architecture, tests and upgrade path in one document, that is a code audit.
Process
- Config and secrets Production debug, APP_KEY uniqueness, .env placement, keys in history.
- Authz and validation Policies, Form Requests, mass assignment, IDOR-shaped routes.
- Edges Uploads, webhooks, queued jobs that trust their payload.
- Written findings Severity as engineering risk, not marketing scores.
Questions that usually come up
Is this a penetration test?
No. It is a code and configuration review. If you need a CREST-style pen test, hire that specialist. I will not sell you a fake certificate.
What do you actually look at?
Secrets, auth, validation, mass assignment, file uploads, webhooks, dependencies u2014 from the codebase, not a questionnaire badge.
Qualification
Discuss your Laravel project
Name, work email, and a short description of the application is enough. No discovery call theatre before I know whether I can actually help.
- UK businesses with a real Laravel (or legacy PHP) application
- Build, support, rescue, upgrade or integration work
- Reply from Oliver Burton, usually within one working day