Do you know the difference between GET and POST requests, and why it's so important that GET requests only ever retrieve data? securinglaravel.com/security-tip... #Laravel

As Laravel's friendly hacker, I feel it is my duty to inform everyone that Laravel v11 is no longer supported! 😱 ❌ Bug fixes (they stopped 6 months ago) ❌ Security fixes (they stop today!) Have you upgraded yet? laravel.com/docs/release... #Laravel

Without an `exp` claim, a JWT can remain valid forever, turning a leaked token into permanent access. securinglaravel.com/security-tip... #Laravel

Rather than checking for essential config when it's used, throw the checks in your Service Provider - you'll know about configuration failures before your users get a weird error. securinglaravel.com/security-tip... #Laravel

PSA for @statamic.com folks - update your sites ASAP! ⚠️ A CRITICAL vuln was discovered that allows full account takeover via password resets! 😱 All the details: cvereports.com/reports/CVE-...

I am determined to get back to @laravellive.dk this year, so if you have a dev team or a meetup in EU or UK and want me to run a workshop or give a talk in August, let me know!

You can't trust an email address you haven't verified, so why are you storing them in your database? securinglaravel.com/in-depth-ema... #Laravel

routes/web.php is boring and reliable, and routes/api.php is fancy, but have you forgotten one? securinglaravel.com/security-tip...

I know I say this all the time (especially on stage!), but apparently not everyone heard me, so here we go again... securinglaravel.com/security-tip...

It's been 4 months, a lot has happened, but I'm finally back to writing securinglaravel.com! New Security Tip coming out in a few hours...

Exhausted after #LaraconAU last week, but excited by how it all went! I was so proud of everyone in my workshop on Wednesday - everyone had a go, and the excitement in the room as they hacked through challenges made it all worth it.

Haven't bought tickets to my [email protected] Security Workshop yet?! 😲 I'll be locking in numbers early next week, so get your ticket TODAY or reach out to me directly. ⌛ This is your final warning... ⏰ events.humanitix.com/lets-hack-pr...

"Let's Hack!", my Pre-Laracon Security Workshop is just FIVE weeks away! 🎉 (So is @laracon.au... but let's be honest, priorities.) Only 11 tickets left, & I need to confirm numbers with the venue, so if you've been thinking about it, now's the time! 👉 events.humanitix.com/lets-hack-pr...

If an API client tries to connect via unencrypted HTTP, what should your API do: redirect to HTTPS, disable HTTP, offer a swift rebuke, or take matters into it's own hands? 🤔 securinglaravel.com/security-tip... #Laravel

Cookies come in many shapes and sizes, and with multiple attributes just to confuse you... Have you ever wondered what the humble HttpOnly attribute actually does? securinglaravel.com/security-tip... #Laravel

We'll never know how @valorin.bsky.social keeps getting invited back to speak at @laracon.au but we do know that he always puts on a heck of a talk when he does! Learn how to defend your Hornburg on November 13-14! Grab your ticket before 29 Sept to get a 👕 in your size 👉 laracon.au/tickets

Security advocate and friendly hacker @valorin.bsky.social keeps finding his way back into the #LaraconAU lineup. Join us on November 13-14 for some practical security tips to help you defend your Hornburg (with or without Gandalf)

Laravel Security Tip: Do You Have a Permissions Policy? What browser features do you have enabled on your site, and what can an XSS attack do if you don't disable them? securinglaravel.com/security-tip... #Laravel

Do you reset your 2FA secret keys when a user toggles TOTP off/on? It's not just passwords you need to worry about when it comes to authentication and stolen credentials: if an attacker can steal a 2FA secret key, they'll always have a valid TOTP! 😱 securinglaravel.com/security-tip... #Laravel

It's important to be paranoid when it comes to production environments - because if you forget you're logged into prod, you may end up dropping a database... or worse! 😱 Laravel's new Prohibitable trait lets you disable Artisan Commands to avoid this! securinglaravel.com/security-tip... #Laravel

You may have heard of the /.well-known/ path, and the security.txt file, but there is a new one you should be aware of too: /.well-known/change-password It should redirect to your change password form, so password managers can easily send users there. securinglaravel.com/security-tip... #Laravel

Content Security Policies are awesome, but if you haven't fully configured all of your directives, it's possible to redirect requests, inherit Nonces, and get juicy CSP-bypassing XSS! 😈 securinglaravel.com/security-tip... #Laravel

Sometimes when I sit down to write a Security Tip it comes together so quickly that I'm surprised I hadn't written it sooner. 🤓 The one I'm about to publish came together perfectly, including the demo, and it has the bonus of being pure nightmare fuel. Win-win for me! 😈

So what you're saying is, you've all been off on a long weekend?

Ugh, I hate it when apps switch from Next/Previous Tab switching to Most Recently Used (MRU) switching with Ctrl+Tab! MRU is only logical when you can't see the other tabs, otherwise it's a UX disconnect between display and keyboard. 😒 Looking at you Telegram! 😡

We talk a lot about protecting password reset and login forms, but don't forget about the humble registration form, it can provide attackers with crucial intel! 😈 securinglaravel.com/security-tip... #Laravel

HTTPS is everywhere & easy, but HTTP is still the default option browsers will attempt when given a raw domain. How do you stop an attacker from abusing this by hijacking the initial HTTP connection attempt? 😱 This is where HSTS comes in... 🔒 securinglaravel.com/security-tip... #Laravel

Technically, XSS involves injecting malicious Javascript, but sometimes you don't need any JS to get up to mischief! 😈 securinglaravel.com/security-tip... #Laravel

Do you know what information is being leaked by the Referer header when your users click on external links? If you site is public, you might be safe - but what if you have internal apps, or sensitive information in your URLs? securinglaravel.com/security-tip... #Laravel #PHP

As useful as it sounds, nl2br() can potentially leave you open to Cross-Site Scripting (XSS) vulnerabilities... you should reach for CSS instead! securinglaravel.com/security-tip... #Laravel

🚨 The #LaraconAU talk titles are live! 🚨 👉 laracon.au/schedule We’ll reveal who’s speaking on what next month - but for now… can you guess? 👀 Submit your guesses and you could win a premium hoodie 🐘💚

Over the years, Stephen's security insights have transformed how I build applications. Not only are they more secure, but I have genuine peace of mind knowing I'm avoiding critical vulnerabilities. If you have 5 minutes to spare, dive into Stephen's content - you won't regret it. 👀

Friendly reminder: Laravel 11 stops receiving bug fixes on Wednesday! 😱 This means you've only got 6 months to upgrade to 12 before security fixes are ended too. Don't put it off or you'll find yourself with an unsupported version before you realise it! ⌛

4 years of Securing Laravel! 🎂 🎉 120 Security Tips 🕵️ 37 In Depth articles Thank you all for the support over the years! securinglaravel.com/4-years/ #Laravel

For those situations where you need to generate a repeatable hash or signature, reach for HMAC, rather than MD5 or SHA1! HMAC's are significantly harder to brute-force and don't suffer from collisions like simpler hashing algos. securinglaravel.com/security-tip... #Laravel

Before you reach for a hashing function, stop and think about what you're hashing and why you're hashing it... securinglaravel.com/security-tip... #Laravel

How should we safely handle resetting forgotten passwords without compromising the protection that MFA provides? securinglaravel.com/security-tip... #Laravel

Do you know the difference between `e()`, `htmlspecialchars()`, & `htmlentities()`, and can we just use `e()` for everything? securinglaravel.com/security-tip... #Laravel

I get this question all the time: Is strip_tags() secure? My answer is always: Yes and No. It depends how and where you use it, so let's take a look at some of the common use cases and pitfalls. securinglaravel.com/security-tip... #Laravel

If anyone know any good jobs or contracts that might interest me in the Sydney NSW area or Fully Remote then hit me up. Enterprisey ie SAP BTP or Startupy ie Full stack on cloud with iac and cicd yada yada #jobhunt

What happens if your users lose their MFA tokens, and they never saved their recovery codes? Can you safely give them back access to their accounts? securinglaravel.com/security-tip... #Laravel

Made it into @valorin.bsky.social's newsletter. If you are a Laravel dev you must follow him for security tips. Highly recommend it!

Search engines like to snoop on all of your files, so be careful what you leave lying around. All it takes is a simple Google Dork to find sensitive data in an exposed `.env` and your app will be compromised... securinglaravel.com/security-tip... #Laravel

While it's tempting to throw everything into your logs, keep in mind where they end up → plain text files, 3rd party collectors, passed around the dev team, etc... 😱 If an attacker can access your logs, they might not need to hack your app! securinglaravel.com/security-tip... #Laravel

I haven't done a sale on Securing Laravel in a while, and I will be disconnected from the internet until Saturday, so now is the perfect time for a sale, right?? I don't like doing things normally, so this just feels right! 😎 Sign up and get 25% off! securinglaravel.com/stephen-is-u...

Account passwords are easy to compromise, so why are you relying on them to verify users within your app? If your users log in with a 2FA Token, then they should be able to prove it before performing other sensitive activities too. 🕵️ securinglaravel.com/security-tip... #Laravel

I normally love light mode, but there is something about Nightwatch in dark mode that just works for me... 🤷 Pretty sure I've got only three dark mode apps now: Terminal, PhpStorm, and Nightwatch.

Early Bird tickets for @laracon.au may have ended last night, but you can still sign up for my Pre-Laracon Security workshop! 🎉 Come to Brisbane a day early and learn how to think like a hacker & find vulnerabilities in your own apps! 🕵️ events.humanitix.com/lets-hack-pr...

This is your reminder to: `composer audit` and `npm audit` your projects Remember, most breaches come from known vulnerabilities. Save yourself a future headache <3

Drawn by @valorin.bsky.social, completed in 39m1 Draw your own at kilopx.com