laravel-securitylisted

# Laravel Security Best Practices ## Constraints - Apply `@rules/security/backend.md` and `@rules/security/frontend.md` - Apply `@rules/php/core-standards.mdc` — `final` classes, `declare(strict_types=1)`, typed signatures - If the project uses Laravel, also apply `@rules/laravel/laravel.mdc`, `@rules/laravel/architecture.mdc`, `@rules/laravel/filament.mdc`, `@rules/laravel/livewire.mdc` - Stack: Laravel 11 / PHP 8.3, Filament, Livewire, Alpine.js, Blade, Tailwind, Pest, Vite, MySQL, Redis - Never hardcode secrets; never reveal them in output - Hard limits: this file stays <= 500 lines and <= 5000 tokens ## Purpose Secure-by-default building blocks for security-sensitive Laravel work. Use the matching section, copy the minimal snippet, and verify against the checklist. For an audit of existing code use `@skills/security-review/SKILL.md`. ## Use when - Setting up authentication / authorization (Sanctum, gates, policies, middleware) - Configuring production settings and environment variables - Writing secure Eloquent queries and models - Hardening CSRF / XSS / input validation / file uploads / API endpoints - Managing secrets, queue payloads, and security event logging ## Production Configuration ```php // config/app.php 'debug' => (bool) env('APP_DEBUG', false), // CRITICAL: never true in production 'key' => env('APP_KEY'), // php artisan key:generate // config/session.php 'secure' => env('SESSION_SECURE_COOKIE', true), 'http_only' => true, 'same_site'