PHP and Laravel Code Security Review

This package reviews the source code of a PHP or Laravel application for security flaws only: injection, missing authorization, mass assignment, unsafe uploads and leaked secrets, with a report that points to the file and line, explains the fix and includes a retest. It is for founders and agencies who inherited a codebase, or are about to sell access to it, and need to know what an attacker would find.

What a security read of Laravel looks like

• whereRaw, DB::raw and orderBy calls fed by request input, and plain PDO queries built by string joining.
• Controllers that load a model through route binding but never check it belongs to the user; missing policies and gates.
• Models with an empty $guarded, so a request can set is_admin or a tenant ID.
• Blade's unescaped output tags, CSRF exceptions added for convenience, and APP_DEBUG left on.
• Uploads stored in public with the client's file name, and keys sitting in .env files committed to Git history.

Dependencies are checked with composer audit on every plan. Business runs Psalm taint analysis and triages the results, so you see real paths from input to sink, not hundreds of warnings. Premium reads queues, jobs, webhooks and signed URLs, checks tenant isolation, and sends a pull request fixing the high-severity findings.

How this differs from a general code review

My Laravel bug fixing and code review package looks at bugs, speed and structure, with security as one section. This one spends all the time on security and maps findings to OWASP ASVS, which helps when a customer sends a security questionnaire.

Access you give, and what stays private

Read access to the repository is enough; production databases and live .env files are never needed. You confirm in writing that you own the code or have the right to have it reviewed. The code is not copied anywhere beyond what the review needs, the report goes only to you, and I sign an NDA on request.