[Security Tip #135] During a recent pentest, I suddenly got hit with 403s on every request. It wasn't a WAF - it was a clever little trap one of my clients built to catch anyone poking at Livewire.…

Yikes! I've been writing Securing Laravel for 5 years! 😲

[Tip #134] Laravel's password helper has a great little feature you may have missed: it can generate browser-friendly password rules automatically! 🤓

Handmade pottery by Stephen — every piece thrown, glazed & fired by hand.

[In Depth #41] unserialize() looks harmless - it just rebuilds your data - but feed it the wrong string and it'll rebuild an attacker's object, quietly turning Laravel's own code into remote code…

[Tip #133] SameSite=Lax is the Laravel default, and it quietly protects you from CSRF. So why do I keep finding SameSite=None in the apps I audit? Let's talk about what it does and how to use it…

[In Depth #41] What do you get when you combine an API, SameSite=None, and a Session cookie?

[Tip #132] Your AI agent hallucinates a package name, confidently installs it, and keeps working - except an attacker registered that exact name, packed with malware. Welcome to slopsquatting.

Looking for a Laravel Security Audit and Pentest? I'm Stephen Rees-Carter and I'm excited to work with you to secure your site, and keep it safe!

Looking for a Laravel Security Audit and Pentest? I'm Stephen Rees-Carter and I'm excited to work with you to secure your site, and keep it safe!

[Tip #131] Updating packages used to be a no-brainer, but now you need to be careful. Updates may be malicious. But not updating leaves vulns unpatched. So what do you do??? 🤷

Looking for a Laravel Security Audit and Pentest? I'm Stephen Rees-Carter and I'm excited to work with you to secure your site, and keep it safe!

[In Depth # 40] We trust version numbers to mean a specific, fixed release - but they're really just labels pointing at a commit, and an attacker can quietly move them. Let's dig into tag hijacking,…

Looking for a Laravel Security Audit and Pentest? I'm Stephen Rees-Carter and I'm excited to work with you to secure your site, and keep it safe!

Looking for a Laravel Security Audit and Pentest? I'm Stephen Rees-Carter and I'm excited to work with you to secure your site, and keep it safe!

[Tip#31] These are my favourite simple security trick to let you know if someone is poking around in your stuff.

We are excited to announce the release of Composer 2.10.0, introducing native malware filtering and consolidated future-proof customizable dependency policy configuration to control the handling of se...

[Tip #130] Laravel Moat is a new tool that assesses the security posture of your GitHub repositories and recommends ways to tighten the controls protecting them.

Moat reviews the security posture of your GitHub organization and repositories, then surfaces recommendations to consider. - laravel/moat

[Tip #129] I love Signed URLs, but there is one very subtle trap you can accidentally fall into...