laravel-security-hardeninglisted

# Laravel Security Hardening (Production Checklist) Small, high-impact controls for admin Laravel apps on shared or client hosting. ## When to use - Before first production deploy - After pen-test or security review - When adding public ops utilities (`fix.php`, setup wizards) ## 1. Lock `/database-setup` after install Middleware `EnsureDatabaseSetupAllowed`: - Allow if `APP_ALLOW_DB_SETUP=true` (temporary recovery only) - Allow if DB unreachable or `users` table missing (first install) - Otherwise return **404** (not 403 — don't advertise the route) ```php Route::prefix('database-setup') ->middleware(EnsureDatabaseSetupAllowed::class) ->group(function () { ... }); ``` `.env` production default: ```env APP_ALLOW_DB_SETUP=false ``` ## 2. Gitignore ops & runtime secrets ```gitignore /public/fix.php /storage/app/ai/settings.json _server_env /_deploy .env .env.production ``` Commit **templates only**: `public/fix.php.example`, not live `fix.php`. See skill: `laravel-deploy-fix-php`. ## 3. Input validation — NoMaliciousInput rule Custom validation rule rejecting obvious XSS/script payloads in user text fields: ```php use App\Rules\NoMaliciousInput; $request->validate([ 'notes' => ['nullable', 'string', new NoMaliciousInput], ]); ``` Patterns block: `<script`, `onerror=`, `<iframe`, `javascript:`, etc. Apply to free-text fields on high-risk forms (assets, tickets, descriptions) — not every field. ## 4. Auth response hygiene - `fix.php` failed key →