Laravel security checklist for enterprise systems

Laravel security is not a slogan plugin. Identity, roles, input, files, deploy secrets, and backups must close before launch. This is the minimum checklist KGSM runs on enterprise systems that hold users and financial documents — not a marketing badge after a breach.

This guide — Laravel security checklist for enterprise systems — is written from KGSM delivery work: scoped first versions, staged releases, and support after handoff.

Audience, risk, and how KGSM works

An IT or system owner who must close security on an enterprise Laravel app before go-live

A post-launch breach means leaked finance data, downtime, and a rebuild that costs more than prevention.

KGSM runs this checklist before enterprise handoff and puts update support in the contract.

Identity, sessions, and roles

Login must be on HTTPS, mark the session cookie HttpOnly and Secure, and never ship admin or a guessable manager email as the default user. Two-factor for finance and super-admin roles has operational value, not just a badge. Lock the account after failed tries and rate-limit /login to slow guessing. “Everyone is admin” in an enterprise app means an intern can export payroll. Build roles with explicit abilities: view, edit, delete, export. Invalidate sessions after a password change so a stolen token dies. In Laravel keep mass assignment behind $fillable and stop admin routes from being guessable URLs. Before handoff KGSM creates an accountant user and tries to open the payroll menu; if it opens, permissions are still wide. That work belongs in web development, not after launch.

Turn debug off in production; file paths are a break-in map. A panel with APP_DEBUG on leaked a controller path to the internet after a validation error.

Input, CSRF, uploads, and XSS

Every enterprise form needs CSRF. Design token APIs separately from cookie forms so the two are not mixed by mistake. Validate in Form Requests, not only in the frontend. Keep Blade escaping on by default and allow {!! !!} only for controlled HTML. Uploads must limit type and size, store a random name, and never execute from a public folder; PHP uploaded as an image still happens. Build SQL with the query builder or bindings; concatenating input into a custom report string is the most common inside hole. Rate-limit contact and password-reset forms to cut spam and mailbox floods. If you have public pages, technical SEO also takes HTTPS and security headers seriously; those are not separate projects. At handoff KGSM posts a forbidden file and a script string at the forms so the checklist is not paper-only.

An intern on an admin role downloaded the payroll Excel because abilities were not split. Split the accountant role from super-admin and test with that account.

Secrets, deploy, and dependencies

Never leave .env in a public repo or a downloadable folder. Keep the app key, database password, and gateway tokens different between production and staging. Turn debug off in production; an error page with file paths is a map for an attacker. Schedule Laravel and Composer updates monthly, not when a breach hits the news. Remove abandoned packages; every dependency is attack surface. Run queue workers as a separate user so one leaked job does not own the web process. If you have several servers, keep APP_KEY in sync or sessions and field encryption break. KGSM hands SSH and hosting panels to the client’s name; secrets on a developer’s personal account mean you lock up when that person leaves. Ask for the update-support path in the contract via contact.

Store uploads outside an executable public path. An image upload dropped a PHP file in public and the site died overnight.

Backups, logs, and restore practice

Skipping backups because month one felt quiet is the classic way to lose financial documents. Database and attachment snapshots need a schedule, encryption, and at least one copy off the production box. Practice restore on staging; a file that will not open is not a backup. Log failed logins, role changes, report exports, and document deletes so disputes and intrusions have evidence. See disk, failed-queue, and SSL-expiry alerts before customers do. A full pentest is not always required; this checklist on real data closes most opportunistic attacks. If internal automation shares the app, separate office automation with roles so a clerk inbox cannot reach payroll export. Security is not a phase after the panel looks pretty; each staged demo should close one of these items.

Backups lived on the same disk; a drive failure took both copies. Put Composer updates on the monthly maintenance calendar.

A backup you never restored is only a feeling of safety. Gateway tokens stayed in a developer’s personal git repo and leaked after they left.

An unlimited password-reset form filled the mailbox with forged requests. Log role changes and report exports.

Do not share .env and gateway keys between staging and production. A panel with APP_DEBUG on leaked a controller path to the internet after a validation error.

An intern on an admin role downloaded the payroll Excel because abilities were not split. Rate-limit login and password reset from day one.

Implementation checklist

• Turn debug off in production; file paths are a break-in map.
• Split the accountant role from super-admin and test with that account.
• Store uploads outside an executable public path.
• Put Composer updates on the monthly maintenance calendar.
• A backup you never restored is only a feeling of safety.
• Log role changes and report exports.
• Do not share .env and gateway keys between staging and production.
• Rate-limit login and password reset from day one.

Field scenario 1

A panel with APP_DEBUG on leaked a controller path to the internet after a validation error.

Turn debug off in production; file paths are a break-in map.

Field scenario 2

An intern on an admin role downloaded the payroll Excel because abilities were not split.

Split the accountant role from super-admin and test with that account.

Field scenario 3

An image upload dropped a PHP file in public and the site died overnight.

Store uploads outside an executable public path.

Field scenario 4

Backups lived on the same disk; a drive failure took both copies.

Put Composer updates on the monthly maintenance calendar.

Field scenario 5

Gateway tokens stayed in a developer’s personal git repo and leaked after they left.

A backup you never restored is only a feeling of safety.

Field scenario 6

An unlimited password-reset form filled the mailbox with forged requests.

Log role changes and report exports.

Related KGSM pages

Continue with KGSM services: سئو و بهینه‌سازی, برنامه‌نویسی و توسعه نرم‌افزار. Related reading: امنیت سایت برای کسب‌وکار ایرانی: حداقل‌های ضروری. For a scoped estimate, use the contact form.

When you apply this on a live team, write it as an operating rule, not a slide: Turn debug off in production; file paths are a break-in map. Then assign an owner and a review date so the rule survives the first busy week.

When you apply this on a live team, write it as an operating rule, not a slide: Split the accountant role from super-admin and test with that account. Then assign an owner and a review date so the rule survives the first busy week.

When you apply this on a live team, write it as an operating rule, not a slide: Store uploads outside an executable public path. Then assign an owner and a review date so the rule survives the first busy week.

When you apply this on a live team, write it as an operating rule, not a slide: Put Composer updates on the monthly maintenance calendar. Then assign an owner and a review date so the rule survives the first busy week.

When you apply this on a live team, write it as an operating rule, not a slide: A backup you never restored is only a feeling of safety. Then assign an owner and a review date so the rule survives the first busy week.

When you apply this on a live team, write it as an operating rule, not a slide: Log role changes and report exports. Then assign an owner and a review date so the rule survives the first busy week.

When you apply this on a live team, write it as an operating rule, not a slide: Do not share .env and gateway keys between staging and production. Then assign an owner and a review date so the rule survives the first busy week.

When you apply this on a live team, write it as an operating rule, not a slide: Rate-limit login and password reset from day one. Then assign an owner and a review date so the rule survives the first busy week.

When you apply this on a live team, write it as an operating rule, not a slide: A panel with APP_DEBUG on leaked a controller path to the internet after a validation error. Then assign an owner and a review date so the rule survives the first busy week.