A bit too friendly...

In Depth: Don't Trust Public Livewire Properties [In Depth #39] Public Properties may look like PHP class properties, but they're really hidden form fields, just waiting for your input... 😈

Livewire's Public Properties may look like PHP class properties, but they're really hidden form fields, just waiting for your input... 😈

securinglaravel.com/in-depth-don... #Laravel

Haha, I actually got a friend who knows crypto randomness stuff to check it for me, to make sure I hadn't made any stupid mistakes!

On the Securing Laravel blog, @valorin.bsky.social explores Laravel security concepts & techniques 🔐 - madewithlaravel.com/securing-lar...

Again, if you have a Substack, the best time to switch away was months ago -- but today's the second best time.

Security Tip: Stop Putting Actions on GET Requests! [Tip #128] Do you know the difference between GET and POST requests, and why it's so important that GET requests only ever retrieve data?

Do you know the difference between GET and POST requests, and why it's so important that GET requests only ever retrieve data?

securinglaravel.com/security-tip... #Laravel

Probably got marked as spam too much, and was causing domain reputational and customer service issues. 🤣

Release Notes | Laravel 12.x - The clean stack for Artisans and agents Laravel is a PHP web application framework with expressive, elegant syntax. We’ve already laid the foundation — freeing you to create without sweating the small things.

As Laravel's friendly hacker, I feel it is my duty to inform everyone that Laravel v11 is no longer supported! 😱

❌ Bug fixes (they stopped 6 months ago)
❌ Security fixes (they stop today!)

Have you upgraded yet?

laravel.com/docs/release... #Laravel

Security Tip: Your JWT Might Be a Forever Key! [Tip #127] Without an `exp` claim, a JWT can remain valid forever, turning a leaked token into permanent access.

Without an `exp` claim, a JWT can remain valid forever, turning a leaked token into permanent access.

securinglaravel.com/security-tip... #Laravel

Security Tip: Validate Config at Boot [Tip #126] Rather than checking for essential config when it's used, throw the checks in your Service Provider - you'll know about configuration failures before your users get a weird error.

Rather than checking for essential config when it's used, throw the checks in your Service Provider - you'll know about configuration failures before your users get a weird error.

securinglaravel.com/security-tip... #Laravel

CVE-2026-27593 - GitHub Advisory Database Statamic is vulnerable to account takeover via password reset link injection

PSA for @statamic.com folks - update your sites ASAP! ⚠️

A CRITICAL vuln was discovered that allows full account takeover via password resets! 😱

All the details: cvereports.com/reports/CVE-...

I am determined to get back to @laravellive.dk this year, so if you have a dev team or a meetup in EU or UK and want me to run a workshop or give a talk in August, let me know!

Yes, I love the Bridgerton soundtracks! They have a good mix of high energy and consistent rhythm that helps me concentrate.

I'm almost always listening to some soundtrack when working, today is BSG.

That adds a whole new level of pain, good luck! 🤞

In Depth: Email Verification Isn't as Simple as You Think [In Depth #38] You can't trust an email address you haven't verified, so why are you storing them in your database?

You can't trust an email address you haven't verified, so why are you storing them in your database?

securinglaravel.com/in-depth-ema... #Laravel

Security Tip: Consider All Routes, Not Just Web! [Tip #125] routes/web.php is boring and reliable, and routes/api.php is fancy, but have you forgotten one?

routes/web.php is boring and reliable, and routes/api.php is fancy, but have you forgotten one?

securinglaravel.com/security-tip...

I know I say this all the time (especially on stage!), but apparently not everyone heard me, so here we go again...

securinglaravel.com/security-tip...

Securing Laravel The essential security resource for Laravel developers.

It's been 4 months, a lot has happened, but I'm finally back to writing securinglaravel.com!

New Security Tip coming out in a few hours...

And my talk on Friday was the most absurd and crazy thing I've done on stage (which is saying something), and I've had some great feedback that's already made it worth it. No idea what I'll do next year...

Exhausted after #LaraconAU last week, but excited by how it all went!

I was so proud of everyone in my workshop on Wednesday - everyone had a go, and the excitement in the room as they hacked through challenges made it all worth it.

Haven't bought tickets to my Pre-@laracon.au Security Workshop yet?! 😲

I'll be locking in numbers early next week, so get your ticket TODAY or reach out to me directly. ⌛

This is your final warning... ⏰
events.humanitix.com/lets-hack-pr...

"Let's Hack!", my Pre-Laracon Security Workshop is just FIVE weeks away! 🎉
(So is @laracon.au... but let's be honest, priorities.)

Only 11 tickets left, & I need to confirm numbers with the venue, so if you've been thinking about it, now's the time!
👉 events.humanitix.com/lets-hack-pr...

Good point! I completely forgot about this option. 🤦

I've updated the article to reflect this.

Security Tip: How Should APIs Respond to HTTP? [Tip #123] If an API client tries to connect via unencrypted HTTP, what should your API do: redirect to HTTPS, disable HTTP, offer a swift rebuke, or take matters into it's own hands?

If an API client tries to connect via unencrypted HTTP, what should your API do: redirect to HTTPS, disable HTTP, offer a swift rebuke, or take matters into it's own hands? 🤔

securinglaravel.com/security-tip... #Laravel

Security Tip: What Is An HttpOnly Cookie? [Tip #86] Cookies come in many shapes and sizes, and with multiple attributes just to confuse you... Have you ever wondered what the humble HttpOnly attribute actually does?

Cookies come in many shapes and sizes, and with multiple attributes just to confuse you... Have you ever wondered what the humble HttpOnly attribute actually does?

securinglaravel.com/security-tip... #Laravel

I was wondering if anyone would get the reference! 🎉

I haven't seen it in a long time, the π is the only thing I remember. Not sure how I'll fit impossible IP addresses into my talk...

Exactly. 😎

Maybe next time I'll do my Ethics talk, that'd make for some fun irony. 😈

Clearly I'm being framed here!

Would I do something like that?

We'll never know how @valorin.bsky.social keeps getting invited back to speak at @laracon.au but we do know that he always puts on a heck of a talk when he does!

Learn how to defend your Hornburg on November 13-14!

Grab your ticket before 29 Sept to get a 👕 in your size 👉 laracon.au/tickets