Laravel production security checklist: debug mode, document root, and authorization gaps

A pre-launch security checklist for Laravel applications argues that several key protections are not on by default and fail silently if left unconfigured. The article covers risks such as XSS, SQL injection, CSRF, session fixation, mass assignment, authorization, brute-force protection, security headers, and proxy trust. Each item is tested against a real Laravel 13.40.0 app over HTTP, with the problem, evidence, fix, and verification step given. In one test, enabling debug mode exposed server paths and stack traces, while disabling it returned a generic error page. Another test showed that serving the project root instead of the public folder exposed the .env file, so the article recommends pointing the web server at public and denying dotfiles.