Config (config.*) — 10

• config.app-debug — APP_DEBUG must be false in production
• config.app-key — APP_KEY must be set
• config.app-env — APP_ENV must not be a development value in production
• config.env-not-committed — .env must be gitignored and never committed
• config.env-example-sync — .env and .env.example must share key sets
• config.env-calls-outside-config — env() calls outside config/ defeat config caching
• config.log-level — Default log channel must not be at debug in production
• config.debug-blacklist — debug_blacklist must redact sensitive env keys when debug is on
• config.trusted-proxies — Trusted proxies must not be wildcard
• config.mail-smtp-encryption — Remote SMTP mailers must force TLS encryption

Cookies & sessions (cookies.*) — 7

• cookies.session-secure — SESSION_SECURE_COOKIE must be true in production
• cookies.session-http-only — SESSION_HTTP_ONLY must be true
• cookies.session-same-site — SESSION_SAME_SITE must be lax or strict
• cookies.session-encrypt — session.encrypt should be true
• cookies.session-lifetime — session.lifetime must be within a reasonable range
• cookies.encrypt-middleware — EncryptCookies middleware must be registered
• cookies.encrypt-excludes — Sensitive cookies must not be in EncryptCookies::$except

Headers (headers.*) — 8

• headers.cors-wildcard — CORS allowed_origins must not be wildcard with credentials enabled
• headers.hsts — HSTS header middleware must be active in production
• headers.x-content-type-options — X-Content-Type-Options: nosniff middleware must be active
• headers.x-frame-options — X-Frame-Options or frame-ancestors must be set
• headers.referrer-policy — Referrer-Policy header middleware should be active
• headers.csp-defined — CSP middleware must be active (requires spatie/laravel-csp)
• headers.csp-unsafe-inline — CSP must not use unsafe-inline or unsafe-eval (requires spatie/laravel-csp)
• headers.csp-base-uri — Spatie CSP policy must include a base-uri directive

Auth (auth.*) — 10

• auth.bcrypt-rounds — BCRYPT_ROUNDS must be 12 or higher
• auth.sanctum-expiration — Sanctum tokens must have an expiration (requires laravel/sanctum)
• auth.login-throttle — Login routes must have throttle middleware
• auth.password-column-plain — User model must hide or hash the password column
• auth.signed-routes-verify — Email verification routes must use signed middleware
• auth.api-ability-scoping — Sanctum tokens must be created with explicit abilities (requires laravel/sanctum)
• auth.signed-url-no-params — Signed URLs must include user-bound route parameters
• auth.otp-rate-limiting — OTP/2FA verification routes must have throttle: middleware
• auth.registration-rate-limit — Registration routes must have throttle: middleware
• auth.jwt-missing-expiration — Tymon JWT jwt.ttl must not be null or 0

CSRF (csrf.*) — 2

• csrf.middleware-disabled — VerifyCsrfToken middleware must be registered
• csrf.except-suspicious — CSRF except list must not contain wildcard patterns

Routing (routing.*) — 2

• routing.state-mutating-get — GET routes must not invoke destroy/delete/remove/deactivate/disable controller methods
• routing.api-http-only — API routes under api/* must enforce HTTPS when APP_URL is http://

Models (models.*) — 4

• models.unguarded — Eloquent models must not use $guarded = []
• models.unguard-call — No static Model::unguard() calls in application code
• models.foreign-key-fillable — Foreign key columns should not be in $fillable
• models.force-fill-user-input — forceFill() calls bypass mass-assignment protection

SQL (sql.*) — 5

• sql.raw-user-input — DB::raw / whereRaw / selectRaw with user input
• sql.raw-order-by — orderByRaw with user input
• sql.variable-table-column — Variable arguments to DB::table / from / select
• sql.validation-rule-injection — Validation rules from variable source
• sql.orwhere-scope-bypass — ->orWhere(...) must not be chained directly off ->where(...) outside a closure group

XSS (xss.*) — 4

• xss.blade-unescaped — Blade {!! $var !!} with PHP variables risks XSS
• xss.html-string — Illuminate\Support\HtmlString produces unescaped HTML
• xss.url-javascript-protocol — javascript: URLs in href/src are XSS sinks
• xss.htmlstring-cast — Eloquent $casts / casts() must not cast attributes to HtmlString::class

Files (files.*) — 5

• files.path-traversal — Storage/File operations with user-controlled paths
• files.unlink-user-input — unlink()/rmdir() in application code
• files.upload-mimes-validation — Validation by extension rather than MIME
• files.public-executable-uploads — Upload rules allowing .php/.phtml/.phar
• files.disk-visibility — Public-visibility disk with a sensitive name/root, or an s3 disk with no explicit visibility

Injection (injection.*) — 5

• injection.command — exec/shell_exec/system/passthru calls
• injection.process-shell — Process::fromShellCommandline() usage
• injection.unserialize — unserialize() of any input
• injection.open-redirect — redirect() with user-controlled URL
• injection.host-header — app.url missing or pointing to localhost

Crypto & secrets (crypto.*) — 5

• crypto.weak-hash — md5/sha1 for security purposes
• crypto.weak-random — rand/mt_rand/uniqid for security tokens
• crypto.cipher-not-pinned — config/app.php does not pin the cipher
• crypto.hardcoded-secret — High-entropy secrets or known token patterns in code
• crypto.password-self-generated — Weak generators (Str::random, md5, uniqid, random_bytes, bin2hex) must not be used in password contexts — use Str::password()

Dependencies (dependencies.*) — 4

• dependencies.composer-audit — wraps composer audit for PHP CVE detection
• dependencies.npm-audit — wraps npm audit when a package.json is present
• dependencies.minimum-stability-dev — composer.json minimum-stability is 'dev' without prefer-stable
• dependencies.outdated-php — PHP version at or near end-of-life

PHP (php.*) — 5

• php.expose-php — expose_php must be off
• php.display-errors — display_errors must be off in production
• php.allow-url-fopen — allow_url_fopen should be off
• php.public-sensitive-files — No .env / .git / .sql backups in public/
• php.phpinfo — No phpinfo() calls in application code

Logging (logging.*) — 3

• logging.dd-dump-debug — No dd() / dump() / var_dump() in application code
• logging.custom-error-pages — resources/views/errors/500.blade.php and 503.blade.php must exist
• logging.sensitive-in-log-context — Log context arrays must not contain password/token/secret keys

Repo & CI (repo.*) — 4

• repo.dependabot — .github/dependabot.yml should exist for automated dep updates
• repo.gitleaks-history — No high-entropy secrets in git history (last 100 commits)
• repo.debug-toolbars — Debug packages (debugbar, telescope) must be in require-dev only
• repo.security-txt — public/.well-known/security.txt should exist so researchers know how to report issues

Ecosystem packages (ecosystem.*) — 5

• ecosystem.telescope-production — Telescope must not be enabled in production without an explicit viewTelescope gate (requires laravel/telescope)
• ecosystem.horizon-gate — Horizon viewHorizon gate must not be trivially true, and must be defined in production (requires laravel/horizon)
• ecosystem.pulse-gate — Pulse viewPulse gate must not be trivially true, and must be defined in production (requires laravel/pulse)
• ecosystem.debugbar-enabled — Debugbar must not be enabled at runtime in production (requires barryvdh/laravel-debugbar)
• ecosystem.livewire-upload-rules — Customized Livewire temporary uploads must keep a max: size rule and not strip throttle middleware (requires livewire/livewire)