Laravel Security Checklist

Blade templates auto-escape output with `{{ }}`. Never use `{!! !!}` (unescaped output) with unsanitized user input.

Use Eloquent ORM or Query Builder with parameter binding. Never concatenate user input into raw DB queries.

Laravel includes CSRF protection by default via the `VerifyCsrfToken` middleware. Ensure all forms include `@csrf`.

Use Laravel's built-in validation (`$request->validate()`) for all incoming data. Define strict validation rules.

Configure `APP_DEBUG=false` in production. Debug mode exposes sensitive application details and stack traces.

Use Laravel's `Hash` facade (bcrypt by default) for password hashing. Never store passwords in plain text.

Use Laravel's rate limiting middleware (`throttle`) on routes, especially authentication endpoints.

Use `php artisan key:generate` to set `APP_KEY` and keep it secret. This key encrypts cookies and signed URLs.