← Feed

Posts

• View post

  Not a bad view to write a new In Depth article. 😎 I'm doing a walkthrough of the results from Claude's security plugin on one of my projects, looking at the quality of the findings and how we can identify the real risks from the noise.

• View post

  How does everyone feel about pentest findings/reports available online (behind auth), as opposed to emailed or sent via Slack/Teams? I've always been wary of putting them online, even behind auth, but I can see some benefits - especially with agents doing the remediation work.

• View post

  Um... that's not how risks work... 🤦 This is the rubbish being peddled by big companies selling "Cyber Insurance". 😡

• View post

  What do you get when you combine an API, SameSite=None, and a Session cookie? https://securinglaravel.com/in-depth-three-reasonable-decisions-one-critical-vulnerability/ #Laravel

• View post

  Working on a fun In Depth article for Securing Laravel at the moment. 😈 The tagline is: What do you get when you combine an API, SameSite=None, and a Session cookie? Any guesses?

• View post

  Your AI agent hallucinates a package name, confidently installs it, and keeps working - except an attacker registered that exact name, packed with malware. Welcome to slopsquatting. https://securinglaravel.com/security-tip-have-you-heard-of-slopsquatting/ #Laravel

• View post

  Recently finished an audit for one of my oldest clients, this was #5! 🕵️ By far the most rewarding part of my job is working with the same clients each year, seeing their apps grow, and their commitment to security strengthen. It's not just a compliance checkbox, it's part of their culture. I've got some capacity coming up, so if you'd like security to be part of your culture too, let's make that happen! Reach out or head over to https://valorinsecurity.com

• View post

  I love Signed URLs, but there is one very subtle trap you can accidentally fall into... https://securinglaravel.com/security-tip-the-signed-url-trap/ #Laravel

• View post

  Livewire's Public Properties may look like PHP class properties, but they're really hidden form fields, just waiting for your input... 😈 https://securinglaravel.com/in-depth-dont-trust-public-livewire-properties/ #Laravel

• View post

  One of my favourite (and oh so simple) hacker tricks is to abuse JSON support in APIs and pass TRUE instead of the actual API key. If the code does loose comparison, you don't need the key! 😎 😈 🍿 https://securinglaravel.com/p/security-tip-type-juggling #PHP #Laravel

• View post

  Do you know the difference between GET and POST requests, and why it's so important that GET requests only ever retrieve data? https://securinglaravel.com/security-tip-stop-putting-actions-on-get-requests/ #Laravel

• View post

  As Laravel's friendly hacker, I feel it is my duty to inform everyone that Laravel v11 is no longer supported! 😱 ❌ Bug fixes (they stopped 6 months ago) ❌ Security fixes (they stop today!) Have you upgraded yet? https://laravel.com/docs/releases#support-policy #Laravel

• View post

  Without an `exp` claim, a JWT can remain valid forever, turning a leaked token into permanent access. https://securinglaravel.com/security-tip-your-jwt-might-be-a-forever-key/ #Laravel

• View post

  Do you reset your 2FA secret keys when a user toggles TOTP off/on? It's not just passwords you need to worry about when it comes to authentication and stolen credentials: if an attacker can steal a 2FA secret key, they'll always have a valid TOTP! 😱 https://securinglaravel.com/security-tip-dont-forget-to-regenerate-2fa-secret-keys/ #Laravel

• View post

  Laravel Security Tip: Do You Have a Permissions Policy? What browser features do you have enabled on your site, and what can an XSS attack do if you don't disable them? https://securinglaravel.com/security-tip-do-you-have-a-permissions-policy/ #Laravel

• View post

  Cookies come in many shapes and sizes, and with multiple attributes just to confuse you... Have you ever wondered what the humble HttpOnly attribute actually does? https://securinglaravel.com/security-tip-what-is-an-httponly-cookie/ #Laravel

• View post

  If an API client tries to connect via unencrypted HTTP, what should your API do: redirect to HTTPS, disable HTTP, offer a swift rebuke, or take matters into it's own hands? 🤔 https://securinglaravel.com/security-tip-how-should-apis-respond-to-http/ #Laravel

• View post

  "Let's Hack!", my Pre-Laracon Security Workshop is just FIVE weeks away! 🎉 (So is @LaraconAU... but let's be honest, priorities.) Only 11 tickets left, & I need to confirm numbers with the venue, so if you've been thinking about it, now's the time! 👉 https://events.humanitix.com/lets-hack-pre-laracon-security-workshop

• View post

  Haven't bought tickets to my Pre-Laracon AU Security Workshop yet?! 😲 I'll be locking in numbers early next week, so get your ticket TODAY or reach out to me directly. ⌛ This is your final warning... ⏰ https://events.humanitix.com/lets-hack-pre-laracon-security-workshop #Laravel #LaraconAU

• View post

  Exhausted after #LaraconAU last week, but excited by how it all went! I was so proud of everyone in my workshop on Wednesday - everyone had a go, and the excitement in the room as they hacked through challenges made it all worth it. And my talk on Friday was the most absurd and crazy thing I've done on stage (which is saying something), and I've had some great feedback that's already made it worth it. No idea what I'll do next year...

• View post

  It's been 4 months, a lot has happened, but I'm finally back to writing securinglaravel.com! New Security Tip coming out in a few hours...

• View post

  I know I say this all the time (especially on stage!), but apparently not everyone heard me, so here we go again... https://securinglaravel.com/security-tip-update-your-packages-yes-this-again

• View post

  routes/web.php is boring and reliable, and routes/api.php is fancy, but have you forgotten one? https://securinglaravel.com/security-tip-consider-all-routes-not-just-web/

• View post

  You can't trust an email address you haven't verified, so why are you storing them in your database? https://securinglaravel.com/in-depth-email-verification-isnt-as-simple-as-you-think/ #Laravel

• View post

  Rather than checking for essential config when it's used, throw the checks in your Service Provider - you'll know about configuration failures before your users get a weird error. https://securinglaravel.com/security-tip-validate-config-at-boot/ #Laravel

• View post

  PSA for Statamic folks - update your sites ASAP! ⚠️ A CRITICAL vuln was discovered that allows full account takeover via password resets! 😱 All the details: https://cvereports.com/reports/CVE-2026-27593 #Laravel