Laravel Security Tip: Do You Have a Permissions Policy? What browser features do you have enabled on your site, and what can an XSS attack do if you don't disable them? securinglaravel.com/security-tip... #Laravel

Do you reset your 2FA secret keys when a user toggles TOTP off/on? It's not just passwords you need to worry about when it comes to authentication and stolen credentials: if an attacker can steal a 2FA secret key, they'll always have a valid TOTP! 😱 securinglaravel.com/security-tip... #Laravel

It's important to be paranoid when it comes to production environments - because if you forget you're logged into prod, you may end up dropping a database... or worse! 😱 Laravel's new Prohibitable trait lets you disable Artisan Commands to avoid this! securinglaravel.com/security-tip... #Laravel

You may have heard of the /.well-known/ path, and the security.txt file, but there is a new one you should be aware of too: /.well-known/change-password It should redirect to your change password form, so password managers can easily send users there. securinglaravel.com/security-tip... #Laravel

Content Security Policies are awesome, but if you haven't fully configured all of your directives, it's possible to redirect requests, inherit Nonces, and get juicy CSP-bypassing XSS! 😈 securinglaravel.com/security-tip... #Laravel

Sometimes when I sit down to write a Security Tip it comes together so quickly that I'm surprised I hadn't written it sooner. 🤓 The one I'm about to publish came together perfectly, including the demo, and it has the bonus of being pure nightmare fuel. Win-win for me! 😈

So what you're saying is, you've all been off on a long weekend?

Ugh, I hate it when apps switch from Next/Previous Tab switching to Most Recently Used (MRU) switching with Ctrl+Tab! MRU is only logical when you can't see the other tabs, otherwise it's a UX disconnect between display and keyboard. 😒 Looking at you Telegram! 😡

We talk a lot about protecting password reset and login forms, but don't forget about the humble registration form, it can provide attackers with crucial intel! 😈 securinglaravel.com/security-tip... #Laravel

HTTPS is everywhere & easy, but HTTP is still the default option browsers will attempt when given a raw domain. How do you stop an attacker from abusing this by hijacking the initial HTTP connection attempt? 😱 This is where HSTS comes in... 🔒 securinglaravel.com/security-tip... #Laravel

Technically, XSS involves injecting malicious Javascript, but sometimes you don't need any JS to get up to mischief! 😈 securinglaravel.com/security-tip... #Laravel

Do you know what information is being leaked by the Referer header when your users click on external links? If you site is public, you might be safe - but what if you have internal apps, or sensitive information in your URLs? securinglaravel.com/security-tip... #Laravel #PHP

As useful as it sounds, nl2br() can potentially leave you open to Cross-Site Scripting (XSS) vulnerabilities... you should reach for CSS instead! securinglaravel.com/security-tip... #Laravel

🚨 The #LaraconAU talk titles are live! 🚨 👉 laracon.au/schedule We’ll reveal who’s speaking on what next month - but for now… can you guess? 👀 Submit your guesses and you could win a premium hoodie 🐘💚

Over the years, Stephen's security insights have transformed how I build applications. Not only are they more secure, but I have genuine peace of mind knowing I'm avoiding critical vulnerabilities. If you have 5 minutes to spare, dive into Stephen's content - you won't regret it. 👀

Friendly reminder: Laravel 11 stops receiving bug fixes on Wednesday! 😱 This means you've only got 6 months to upgrade to 12 before security fixes are ended too. Don't put it off or you'll find yourself with an unsupported version before you realise it! ⌛

4 years of Securing Laravel! 🎂 🎉 120 Security Tips 🕵️ 37 In Depth articles Thank you all for the support over the years! securinglaravel.com/4-years/ #Laravel

For those situations where you need to generate a repeatable hash or signature, reach for HMAC, rather than MD5 or SHA1! HMAC's are significantly harder to brute-force and don't suffer from collisions like simpler hashing algos. securinglaravel.com/security-tip... #Laravel

Before you reach for a hashing function, stop and think about what you're hashing and why you're hashing it... securinglaravel.com/security-tip... #Laravel

How should we safely handle resetting forgotten passwords without compromising the protection that MFA provides? securinglaravel.com/security-tip... #Laravel

Do you know the difference between `e()`, `htmlspecialchars()`, & `htmlentities()`, and can we just use `e()` for everything? securinglaravel.com/security-tip... #Laravel

I get this question all the time: Is strip_tags() secure? My answer is always: Yes and No. It depends how and where you use it, so let's take a look at some of the common use cases and pitfalls. securinglaravel.com/security-tip... #Laravel

If anyone know any good jobs or contracts that might interest me in the Sydney NSW area or Fully Remote then hit me up. Enterprisey ie SAP BTP or Startupy ie Full stack on cloud with iac and cicd yada yada #jobhunt

What happens if your users lose their MFA tokens, and they never saved their recovery codes? Can you safely give them back access to their accounts? securinglaravel.com/security-tip... #Laravel

Made it into @valorin.bsky.social's newsletter. If you are a Laravel dev you must follow him for security tips. Highly recommend it!

Search engines like to snoop on all of your files, so be careful what you leave lying around. All it takes is a simple Google Dork to find sensitive data in an exposed `.env` and your app will be compromised... securinglaravel.com/security-tip... #Laravel

While it's tempting to throw everything into your logs, keep in mind where they end up → plain text files, 3rd party collectors, passed around the dev team, etc... 😱 If an attacker can access your logs, they might not need to hack your app! securinglaravel.com/security-tip... #Laravel

I haven't done a sale on Securing Laravel in a while, and I will be disconnected from the internet until Saturday, so now is the perfect time for a sale, right?? I don't like doing things normally, so this just feels right! 😎 Sign up and get 25% off! securinglaravel.com/stephen-is-u...

Account passwords are easy to compromise, so why are you relying on them to verify users within your app? If your users log in with a 2FA Token, then they should be able to prove it before performing other sensitive activities too. 🕵️ securinglaravel.com/security-tip... #Laravel

I normally love light mode, but there is something about Nightwatch in dark mode that just works for me... 🤷 Pretty sure I've got only three dark mode apps now: Terminal, PhpStorm, and Nightwatch.

Early Bird tickets for @laracon.au may have ended last night, but you can still sign up for my Pre-Laracon Security workshop! 🎉 Come to Brisbane a day early and learn how to think like a hacker & find vulnerabilities in your own apps! 🕵️ events.humanitix.com/lets-hack-pr...

This is your reminder to: `composer audit` and `npm audit` your projects Remember, most breaches come from known vulnerabilities. Save yourself a future headache <3

Drawn by @valorin.bsky.social, completed in 39m1 Draw your own at kilopx.com

Stack traces are essential for debugging complex (and even simple) issues, but there is a risk that something sensitive might be exposed within your trace... Let's ensure that doesn't happen! securinglaravel.com/security-tip... #Laravel

🎤 Next up in our final #LaraconAU reveal week: @jominney.bsky.social, Digital Experience Lead at Devhouse! UX, human-centred design, and digital products that actually serve people. Jo’s the real deal.

Don't forget to disable Debug Mode on world-accessible Apps! ⚠️ It may seem obvious, you'd be surprised just how often I come across websites where debug mode is enabled, and what it allows an attacker to do... securinglaravel.com/security-tip... #Laravel

It's time to finally fulfil one of the most common requests for an In Depth article: setting up 2FA! 🎉 So let's add some TOTP 2FA to our boring user/pass auth login! securinglaravel.com/in-depth-set... #Laravel

I built a ridiculous 1000 pixel display that takes an hour to draw an image and I'm now asking the internet to draw on it (what could go wrong?) Please submit some 40×25 pixel art at kilopx.com!

To all of those social butterflies in Denver - enjoy Laracon! Don’t forget to keep an eye out for someone seeming on the outer, someone needing to feel included, someone needing a smile. There are lots of invisible developers out there. Try to do something that can help others feel seen.

As requested, I'm working on it... 🤓

Off to a good start this week: I thought @dyrynda.au was supposed to be in the air already, but I got my timing slightly wrong... 🤦 Still, it's not all bad, now he'll spend his entire 15 hour flight wondering what I'm up to. 😈

Anyone want to throw a pile of money at me to fund a really cool research idea I have? 🤣 Will take a bit of time to get set up, but would be a great thing to have in the Laravel and PHP community.

Worried about the security of your Laravel app, or found some vulnerable code and need to check there isn't more? 😱 Book in a Laravel Security Audit and Penetration Test today! I'll help secure your code, find vulnerabilities, and give practical advice for Laravel apps! DM or valorinsecurity.com

This is your periodic reminder to ensure bcrypt rounds is set to 12 (or higher)! Laravel's default was increased from 10 to 12 2 years ago, so if you're working on an older codebase, make sure you've updated `bcrypt.rounds`. securinglaravel.com/security-tip... #Laravel

The State Of Laravel 2025 survey has started! You can now participate to identify how the ecosystem changed over the past 12 months! Please RT for reach ❤️ stateoflaravel.com/participate?...

We've all heard about SQLi and XSS, but what about another big injection vector: Command Injection? It's less common but just as critical if your app does anything on the command line. Plus, it's not as easy to blindly escape be done... 😯 securinglaravel.com/security-tip... #Laravel

For those who missed it, I recently launched sponsors on Securing Laravel! 🎉 Sponsoring SL is the perfect way to get your brand in front of thousands of security-conscious Laravel devs, and support my security work within the community. More details: securinglaravel.com/sponsor/

It's easy to say "Update <package> if it's installed!", but how do you actually know if a package is installed, since it may not appear in composer.json?! Also, how did it even get there??!! 🤨 securinglaravel.com/security-tip... #Laravel

Something I should have included in the original post: Livewire may be included through a dependency, like Pulse or Filament, and not show up in your composer.json! 🚨 Run `composer show livewire/livewire` to check if it's installed - or just update everything regardless!

⚠️ New CRITICAL vulnerability disclosed in Livewire v3, you need to update ASAP! ⚠️ This is a rather sneaky one that gives an attacker RCE (under the right conditions), and can be done unauthenticated with no user input... hence CRITICAL. 😱 securinglaravel.com/security-not... #Laravel