laravel-owasp-security — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited laravel-owasp-security (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Dual-purpose security skill for Laravel 13 + React/Inertia.js applications. Run a full OWASP Top 10 audit against a codebase, or use as a secure coding reference when building features.
Check if the project uses React + Inertia.js by looking for:
app/Http/Middleware/HandleInertiaRequests.php existsresources/js/ contains .tsx or .jsx filesinertiajs/inertia-laravel in composer.json@inertiajs/react in package.jsonIf detected, state at the top of the report:
"React + Inertia.js detected — Laravel OWASP checklist AND React/Inertia security checks will both be applied."
If not detected, state:
"No React/Inertia.js detected — applying Laravel OWASP checklist only."
$ARGUMENTS): review only those files or featuresWork through every item below. For each, output:
file:line, a description of the vulnerability (do NOT reproduce any code, values, API keys, tokens, or .env contents from the file), and a fix recommendationauth, role:admin, etc.)->where('user_id', auth()->id())Hash::make() or 'hashed' Eloquent cast — never stored as plaintextCrypt::encryptString() or 'encrypted' Eloquent castAPP_KEY is long, random, and unique per environmentURL::signedRoute()) used for sensitive one-time actions (password reset, email verify)SQL & Mass Assignment:
whereRaw(), selectRaw(), orderByRaw() — use ? bindings$request->all() passed directly to create(), fill(), or update()forceFill() or forceCreate() with unvalidated user input$fillable explicitly — not $guarded = []$request->validated() for mass operationsXSS — Blade & React:
{!! $userInput !!} in Blade templates with untrusted data{{ }} used for all user-supplied Blade outputdangerouslySetInnerHTML in React without DOMPurify.sanitize() firsthref and src attributes not set from unvalidated user inputeval(), new Function(), or setTimeout(string) with user-controlled stringsintegrity="sha384-...")APP_DEBUG=false in production.env is in .gitignore and never committedstorage/ and bootstrap/cache/ have correct permissions (not world-writable)APP_KEY is set and unique per environmentallowed_origins is not ['*'] for authenticated API routescomposer audit passes with no known CVEsnpm audit passes with no known CVEsAuth:
throttle middleware or RateLimiter in LoginRequestsession()->regenerate() called after successful loginCookie & Session:
http_only = true in config/session.phpsame_site = lax or strict in config/session.phpsecure = true or null (auto for HTTPS) in config/session.phplifetime is a reasonable value (15–30 min recommended for most apps)domain = null unless subdomains are neededEncryptCookies middleware is in the web groupCSRF:
VerifyCsrfToken middleware active in the web group@csrf directive used in all non-Inertia POST formsvalidateCsrfTokens(except: [...]) are justifiedDeserialization:
unserialize($request->input(...))eval($request->input(...))extract($request->all())Http::get($request->input('url')) with unvalidated URLsNot part of the OWASP Top 10 but critical for Laravel applications.
exec(), shell_exec(), system(), passthru() with user inputredirect($request->input('url')) with unvalidated URLsmimes:, max: — filenames never derived from raw user inputContent-Security-Policy set — with nonces (Vite::useCspNonce()) if possibleX-Frame-Options setX-Content-Type-Options setStrict-Transport-Security set for HTTPSReferrer-Policy setPermissions-Policy setOnly run if React + Inertia.js detected in Step 1.
dangerouslySetInnerHTML={{ __html: userInput }} without DOMPurify.sanitize() firsthref and src attributes not set from unvalidated user input — javascript: URLs execute scriptseval(), new Function(), or setTimeout(string) with user-controlled stringshttps:// or http:// only)HandleInertiaRequests::share() does NOT expose passwords, tokens, or internal-only flags->only([...]) or API Resources — not raw model toArray()data-page HTML attribute on initial loadX-XSRF-TOKEN header not disabledfetch or axios calls include CSRF token manually if bypassing Inertia's routerauth.user Inertia prop excludes password hash, remember tokens, and 2FA secretsauth.user contains only fields the UI actually needslocalStorage or sessionStorage — use HttpOnly cookiesVITE_* env vars contain no secrets — they are public by designnpm audit passes with no high/critical CVEs in React or Inertia packagesStructure the audit report as:
## Laravel OWASP Security Audit Report
> React + Inertia.js detected — Laravel OWASP checklist AND React/Inertia security checks will both be applied.
### 1. Broken Access Control (A01:2021)
- **PASS** `app/Http/Middleware/RoleMiddleware.php` — role middleware applied to all route groups
- **FAIL** `app/Http/Controllers/PaymentController.php:42` — Payment model fetched without ownership check (direct object reference exposure). Fix: scope the query to the authenticated user.
[Continue for all 10 OWASP checks + Additional Checks + R1–R6 React/Inertia checks]
---
## Summary
### Critical Issues (fix immediately)
1. ...
### Warnings (fix soon)
1. ...
### Passed
X checks passed.
### Recommended Commands
composer audit
npm auditReference the rule files when:
dangerouslySetInnerHTML in React components| Priority | Category | Impact | Rule File |
|---|---|---|---|
| 1 | Broken Access Control | CRITICAL | sec-broken-access-control |
| 2 | Cryptographic Failures | CRITICAL | sec-cryptographic-failures |
| 3 | Injection Prevention | CRITICAL | sec-injection-prevention |
| 4 | XSS & React/Inertia | HIGH | sec-xss-react-inertia |
| 5 | CSRF Protection | HIGH | sec-csrf-protection |
| 6 | Security Misconfiguration | HIGH | sec-security-misconfiguration |
| 7 | Authentication & Rate Limiting | HIGH | sec-authentication-rate-limiting |
| 8 | Inertia Data Exposure | HIGH | sec-inertia-data-exposure |
sec-broken-access-control — Middleware, ownership checks, policies, scoped queriessec-cryptographic-failures — Password hashing, encrypted casts, signed URLssec-injection-prevention — SQL injection, mass assignment, raw query bindingssec-xss-react-inertia — dangerouslySetInnerHTML, DOMPurify, href/src validationsec-csrf-protection — VerifyCsrfToken, webhook exclusions, Inertia CSRFsec-security-misconfiguration — APP_DEBUG, APP_KEY, security headers, CORSsec-authentication-rate-limiting — Throttle, session regeneration, brute force preventionsec-inertia-data-exposure — data-page attribute exposure, secret props, API ResourcesRead individual rule files for detailed explanations and code examples:
rules/sec-broken-access-control.md
rules/sec-cryptographic-failures.md
rules/sec-injection-prevention.md
rules/sec-xss-react-inertia.md
rules/sec-csrf-protection.md
rules/sec-security-misconfiguration.md
rules/sec-authentication-rate-limiting.md
rules/sec-inertia-data-exposure.mdEach rule file contains:
For the complete guide with all rules expanded: AGENTS.md
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.