security by loulanyue
Laravel Security Best Practices loulanyue/laravel-security
Laravel security best practices for authn/authz, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment.
What it changes View full report → Passed 20 of 22 test cases with the skill, and 18 of 22 without it.
Without skill 82%
With skill 91%
Checks it passed that the model alone missed 2 fixed18 passed either way2 still failing0 broke
Pass-rate lift +9 pp
Tokens +63%
Agent turns 0%
Response time -37% Model gemini-3.6-flashMeasured 8/22/2026 v6 20 of 22 cases passed with skill
Use this skill Claude Code DecimalAI agent CLI & files
Save it into your project's skills folder. Claude Code picks it up in its next session.
curl -fsSL --create-dirs -o .claude/skills/loulanyue-laravel-security/SKILL.md https://app.decimal.ai/s/loulanyue-laravel-security/SKILL.md Copy command Copy SKILL.md
Want it pinned and updatable? pip install "decimalai>=0.15", then decimalai skills add loulanyue-laravel-security, and start Claude Code with claude --plugin-dir "$(git rev-parse --show-toplevel)/.agents"
Linked stays up to date: your agents get the author's new versions automatically.
Editable copy is yours to change; the author's updates won't reach it.
Install linked skill Create editable copy
1 · One-time — install the CLI (
docs ↗ )
$ pip install "decimalai>=0.15"Copy
2 · Get the skill — writes .agents/skills/loulanyue-laravel-security/ and pins it in .decimal/skills.lock
$ decimalai skills add loulanyue-laravel-securityCopy
Copy link Copy README badge Copy SKILL.md No CLI? Get the same file — curl · raw file $ curl -fsSL --create-dirs -o .claude/skills/loulanyue-laravel-security/SKILL.md https://app.decimal.ai/s/loulanyue-laravel-security/SKILL.mdCopy
Safety checks: 3 of 3 passed
Code scan Clean Intent Passed Content Clean
Overview Benchmark Contents Activity Versions 6 Ratings 0
See it in action One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
Prompt We need to protect a PUT route '/projects/{project}' in Laravel so that only users authorized to update the given project can access it. Should we handle authorization manually inside the controller method or attach middleware to the route definition? Show the route definition using Laravel's built-in policy middleware.
What was checked, without and with the skill Checked Without skill With skill Applies policy authorization middleware can:update,project to the route definition. Combines authorization middleware alongside Sanctum authentication middleware.
Show both answers
What's inside The instructions your model reads when the skill loads.
SKILL.md 286 lines single file
Laravel Security Best Practices
Comprehensive security guidance for Laravel applications to protect against common vulnerabilities.
When to Activate
Adding authentication or authorization
Handling user input and file uploads
Building new API endpoints
Managing secrets and environment settings
Hardening production deployments
How It Works
Middleware provides baseline protections (CSRF via VerifyCsrfToken, security headers via SecurityHeaders).
Guards and policies enforce access control (auth:sanctum, $this->authorize, policy middleware).
Form Requests validate and shape input (UploadInvoiceRequest) before it reaches services.
Rate limiting adds abuse protection (RateLimiter::for('login')) alongside auth controls.
Data safety comes from encrypted casts, mass-assignment guards, and signed routes (URL::temporarySignedRoute + signed middleware).
Core Security Settings
APP_DEBUG=false in productionAPP_KEY must be set and rotated on compromiseSet SESSION_SECURE_COOKIE=true and SESSION_SAME_SITE=lax (or strict for sensitive apps)
Configure trusted proxies for correct HTTPS detection
Session and Cookie Hardening
Set SESSION_HTTP_ONLY=true to prevent JavaScript access
Use SESSION_SAME_SITE=strict for high-risk flows
Regenerate sessions on login and privilege changes
Authentication and Tokens
Use Laravel Sanctum or Passport for API auth
Prefer short-lived tokens with refresh flows for sensitive data
Revoke tokens on logout and compromised accounts
Example route protection:
Track record Benchmark 20 / 22
test cases passed, vs 18 / 22 without
Adoption
Users 0
Times used 0 View activity → Safety and source details
SkillSafety ✓ 3 of 3 passed ✓ Code scan 15 of 15 checks clean
0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026
View 15 scanner checks live_secret remote_code_execution reverse_shell data_exfiltration ssrf_metadata agent_snooping anti_refusal destructive_commands obfuscated_unicode unicode_homoglyph opaque_blob suspicious_url tool_overreach trigger_abuse prompt_injection_phrasing
✓ Intent Safe
LLM judge · does the skill do what it claims
✓ Content Clean
LLM judge · policy & harmful-content review
Source Imported loulanyue / awesome-claude-notes
docs/ja-JP/skills/laravel-security/SKILL.md
View on GitHub ↗ License MITImported 8/3/2026Version v6