APP_DEBUG in production
Debug error pages that show configuration, queries and file paths to visitors.
Laravel security audit & upgrades
Lock down your Laravel app and bring it up to date.
A security audit for Laravel applications, plus upgrades across major versions, with a fixed price for the work.
- Old and current versions
- Agencies welcome
- Fixed-price quotes
- laravel/framework10.x · end of life
- APP_DEBUGtrue
- /telescopepublic
- /horizonlogin required
- /.env readableno
- $guarded = []3 models
- Composer advisories2 packages
Example findings● 5 to fix
What we check
The Laravel-specific mistakes that turn a working app into an easy target.
Telescope, Horizon and Ignition
Dashboards and debug routes that are reachable without a login.
End-of-life Laravel versions
Framework versions that no longer get security fixes, and the PHP version under them.
Mass assignment
Models with an empty $guarded and request data passed straight into create() or update().
Policies and gates
Routes that load a record by ID without checking the user is allowed to see it.
Sanctum and Passport
Token abilities and expiry, stateful domains, CORS and cookie settings.
Queues and storage
Private files on the public disk, unsigned download links, and Redis or queue workers open to the internet.
.env handling
A .env file committed to git or readable from the web, and an APP_KEY that has leaked.
Composer dependencies
Your composer.lock checked against published security advisories.
How it works
Free external scan
A read-only check of your public site, including exposed debug pages and files.
Run a scan →Audit and written report
We review the code, config, packages and hosting, then write up each finding and how serious it is.
Book a call →Fixes or upgrade
Your team fixes it from the report, or we do it for a fixed price, including major version upgrades.
Ask for a quote →What you get
A plain-English report
Each finding explained with the file, route or setting involved. Readable by the owner, useful to the developer.
Prioritised fixes
Ordered by risk, with an upgrade path if your Laravel or PHP version is out of support.
A fixed quote for the work
One price for the fixes or upgrade, agreed in writing. Nothing extra without your approval.
Pricing: fixed-price quote after a free 15-minute call. Run by Daniel Lasek, a developer who does hacked-server forensics.
Book the callFree tools
Check the basics yourself before you talk to anyone.
Website security scan
Read-only check of your public pages in about 30 seconds.
Run a scan →Composer vulnerability checker
Paste your composer.lock and see which packages have known advisories.
Check packages →laravel/framework advisories
Known security issues in Laravel itself, and which versions are affected.
See advisories →Beyond security
An app that is hard to upgrade is hard to keep safe. We can take on the longer work too.
Upgrades
Laravel and PHP major versions, one step at a time, with tests.
Refactors
Fat controllers and risky code made safer and easier to change.
Maintenance retainers
Monthly framework and package updates, so you stay on a supported version.
New features
Once the app is safe and current, we can build on it.
Questions
Which Laravel versions still get security fixes?
As of November 2026, Laravel 12 gets security fixes until 24 February 2027 and Laravel 13 until 17 March 2028. Laravel 11 and older no longer get security fixes. Bug fixes for Laravel 12 ended on 13 August 2026.
Can you upgrade us from an old Laravel version?
Yes. We move one major version at a time and run your tests at each step. Older apps often need a PHP upgrade as well, so we plan both together and quote the whole path up front.
Is APP_DEBUG=true in production really a problem?
Yes. Laravel's own documentation says it should always be false in production. Debug error pages can show configuration values, database details and file paths to anyone who triggers an error.
Do you need access to our code or server?
Not for the free scan, which only reads your public pages. The audit needs read access to the repository and ideally the server or hosting setup. We confirm you own the app, or are authorised to have it tested, first.
How much does a Laravel audit cost?
It depends on the size of the app. You get a fixed-price quote after a free 15-minute call, in writing, before any work starts.
Do you offer ongoing maintenance?
Yes. After the audit or upgrade we can keep the framework and packages patched on a monthly retainer, with the scope agreed in writing.
See the full support table in Laravel versions: which still get security fixes? For plain PHP apps, see PHP security audit & fixes.
Start with a free scan
Read-only, about 30 seconds. Then book a 15-minute call for a fixed quote.