Ignition Exposure Check: What StackShield Detects
Checks if Laravel Ignition error page is exposed in production.
What This Check Detects
Checks if Laravel Ignition error page is exposed in production.
Full Documentation
What this check looks for
StackShield probes for Laravel Ignition, the debug error page that ships with modern Laravel, and its associated routes such as the execute-solution endpoint. It is checking whether Ignition is reachable and active in production rather than confined to local development.
Why it matters
Ignition is a superb development tool and a serious production liability. Its error pages render environment variables, stack traces and application internals. Worse, Ignition has a history of exploitable vulnerabilities, most notably CVE-2021-3129, which allowed remote code execution on applications running it in debug mode. When that was disclosed, exploitation was widespread within a day precisely because so many production apps had it exposed.
An exposed Ignition endpoint combines two of the worst properties: it leaks the information an attacker needs to plan an attack, and it has itself been a direct route to code execution.
What a failed check means
A failed check means Ignition responded in a way consistent with being active in production. That is a high-severity finding, both for the information it discloses and for the exploitation history of the tooling itself.
The fix is ensuring debug mode is off in production, which disables Ignition's interactive features, and keeping the package updated so any future advisory is already patched.
See the step-by-step remediation: how to fix this.
Related Security Checks
Is your Laravel app exposed right now?
34% of Laravel apps we scan have at least one critical issue, and most teams do not find out until something breaks. The free scan checks your live app in 60 seconds. Then StackShield re-runs every check after each deploy, so a fix you ship today does not quietly regress next week.