# Laravel Security Guide: Every Vulnerability, Fix Guide & Checklist in One Place > The complete index of Laravel security resources. Find fix guides for exposed .env files, debug mode, XSS, CSRF, CORS, session security, and more. Plus checklists, comparison pages, and free scanning tools. **Author:** Matt King | **Published:** March 6, 2026 | **Category:** Security --- This page is a living index of every Laravel security resource on StackShield. Whether you need to fix a specific vulnerability, run through a pre-deployment checklist, or compare security tools, start here. --- ## Fix Guides Step-by-step instructions for fixing the most common Laravel security issues. Each guide includes code examples, server configurations, and verification steps. **Critical** - [Exposed .env File](/fix/exposed-env-file) - Block public access and rotate all compromised credentials - [Debug Mode in Production](/fix/debug-mode-production) - Disable APP_DEBUG and stop leaking stack traces - [Telescope Exposed](/fix/telescope-exposed) - Gate Telescope behind authentication in production - [Ignition Exposed](/fix/ignition-exposed) - Remove or restrict the Ignition debug page **High** - [XSS Prevention](/fix/xss-prevention) - Blade {!! !!} risks, output encoding, and CSP headers - [CORS Misconfiguration](/fix/cors-misconfiguration) - Fix wildcard origins and credentials in config/cors.php - [Missing CSRF Protection](/fix/missing-csrf-protection) - Add @csrf tokens and configure VerifyCsrfToken - [Insecure Session Config](/fix/insecure-session-config) - Set Secure, HttpOnly, and SameSite cookie flags - [Weak SSL/TLS](/fix/weak-ssl-tls) - Disable old protocols and configure strong cipher suites - [Missing Security Headers](/fix/missing-security-headers) - Add HSTS, CSP, X-Frame-Options, and more - [Subdomain Takeover](/fix/subdomain-takeover) - Audit and clean up dangling DNS records - [Missing Rate Limiting](/fix/missing-rate-limiting) - Protect login and API endpoints from brute force - [SQL Injection Prevention](/fix/sql-injection-prevention) - Use parameterized queries, avoid DB::raw with user input - [JWT Token Vulnerabilities](/fix/jwt-token-vulnerabilities) - Secure token signing, expiry, and validation - [Exposed Git Directory](/fix/exposed-git-directory) - Block access to .git in production - [Exposed Storage Directory](/fix/exposed-storage-directory) - Prevent public browsing of /storage **Medium** - [Directory Listing Enabled](/fix/directory-listing-enabled) - Disable Options +Indexes in Apache and Nginx - [Missing Email Security](/fix/missing-email-security) - Configure SPF, DKIM, and DMARC - [DNS Security Issues](/fix/dns-security-issues) - Fix dangling records and DNSSEC configuration --- ## Security Checklists Actionable checklists you can copy into your deployment workflow. - [Production Deployment Checklist](/checklists/production-deployment) - Everything to verify before going live - [API Security Checklist](/checklists/api-security) - Secure your Laravel API endpoints - [Authentication Checklist](/checklists/authentication) - Login, session, and password security - [Post-Breach Response](/checklists/post-breach) - What to do if your app is compromised See also: [Laravel Security Checklist 2026: 25 Checks Before You Ship](/blog/laravel-security-checklist-2026) for a comprehensive walkthrough of every check. --- ## In-Depth Guides Longer posts covering specific security topics. - [Laravel XSS Protection: Complete Guide](/blog/laravel-xss-protection-guide) - Blade escaping, JavaScript contexts, CSP headers - [How to Security Audit a Laravel Application](/blog/laravel-security-audit-guide) - 5-phase audit process with commands and time estimates - [Composer Vulnerability Management](/blog/composer-vulnerability-management) - Complete guide to composer audit, config, and CI/CD integration - [CORS Misconfigurations in Laravel](/blog/cors-misconfigurations-laravel) - Wildcard origins, reflected headers, and config/cors.php - [NIST DNS Security Update (SP 800-81r3)](/blog/nist-dns-security-sp-800-81r3) - 6 changes that affect your infrastructure - [CVE-2025-54068: Livewire RCE Vulnerability](/blog/livewire-rce-cve-2025-54068) - Critical RCE in Livewire v3 - [OWASP Top 10 for Laravel](/blog/owasp-top-10-laravel) - How each OWASP category applies to Laravel --- ## Comparison Pages See how StackShield compares to other security tools. - [StackShield vs Nuclei](/compare/nuclei) - Managed monitoring vs open-source scanning - [StackShield vs Detectify](/compare/detectify) - Laravel-specific vs general EASM - [StackShield vs OWASP ZAP](/compare/owasp-zap) - Continuous monitoring vs manual scanning - [StackShield vs Laravel Shift](/compare/laravel-shift) - Security monitoring vs upgrade automation - [All comparisons](/compare) --- ## Free Tools - [Free Laravel Security Scanner](/tools/laravel-scanner) - Scan your app for vulnerabilities in minutes - [Security Headers Checker](/tools/header-check) - Analyze your HTTP security headers with A-F grading - [Free Scan](/free-scan) - Quick external security check --- ## Stay Protected One-off audits catch today's issues. Configuration can regress after every deployment, server migration, or infrastructure change. [StackShield](https://stackshield.io) runs 30+ Laravel-specific security checks continuously and alerts you the moment something changes. [Run a free scan](/free-scan) to see your current security posture, or explore the [full list of checks](/tools/laravel-scanner) we run. --- ## Frequently Asked Questions ### How do I perform a security audit on a Laravel application? Start by checking for exposed .env files, verifying security headers (CSP, X-Frame-Options, HSTS), testing CSRF and XSS protections, reviewing file upload handling, checking rate limiting on login and API endpoints, confirming debug mode is off in production, and auditing DNS records for dangling entries. Tools like StackShield automate these checks by scanning your production app externally. ### What are the most common Laravel security vulnerabilities? The most common vulnerabilities are exposed .env files with database credentials and API keys, missing security headers that enable XSS and clickjacking, CSRF token misconfiguration, insecure file upload handling, missing rate limiting on authentication endpoints, debug mode left enabled in production, and DNS misconfigurations that allow subdomain takeover. ### Should I run a bug bounty program for my Laravel app? Yes, even a basic responsible disclosure policy helps. Add a security.txt file at /.well-known/security.txt with contact details. For formal bug bounty programs, platforms like HackerOne and Bugcrowd let you define scope and rewards. Focus bounty scope on authentication, authorization, and data handling endpoints rather than debug or development routes. ### How do I check if my Laravel .env file is exposed? Try accessing yourdomain.com/.env in a browser. If it returns any content, your .env file is publicly accessible and your credentials are compromised. Ensure your web server is configured to block access to dotfiles. In Nginx, add a location block that denies access to files starting with a dot. In Apache, use .htaccess rules to deny access.