> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

<AccordionGroup>
  <Accordion title="laravel-unsafe-validator">
    Found a request argument passed to an `ignore()` definition in a Rule constraint. This can lead to SQL injection.<br />**Likelihood**: HIGH<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    <br />**OWASP**: <br />- A01:2017 - Injection
    <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="laravel-cookie-long-timeout">
    Found a configuration file where the lifetime attribute is over 30 minutes.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag
    <br />**OWASP**: <br />- A05:2021 - Security Misconfiguration
  </Accordion>

  <Accordion title="laravel-cookie-same-site">
    Found a configuration file where the same\_site attribute is not set to 'lax' or 'strict'. Setting 'same\_site' to 'lax' or 'strict' restricts cookies to a first-party or same-site context, which will protect your cookies and prevent CSRF.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-1275: Sensitive Cookie with Improper SameSite Attribute
    <br />**OWASP**: <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="laravel-cookie-null-domain">
    Found a configuration file where the domain attribute is not set to null. It is recommended (unless you are using sub-domain route registrations) to set this attribute to null so that only the same origin can set the cookie, thus protecting your cookies. <br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
    <br />**OWASP**: <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="laravel-dangerous-model-construction">
    Setting `$guarded` to an empty array allows mass assignment to every property in a Laravel model. This explicitly overrides Eloquent's safe-by-default mass assignment protections.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
    <br />**OWASP**: <br />- A08:2021 - Software and Data Integrity Failures
  </Accordion>

  <Accordion title="laravel-active-debug-code">
    Found an instance setting the APP\_DEBUG environment variable to true. In your production environment, this should always be false. Otherwise, you risk exposing sensitive configuration values to potential attackers. Instead, set this to false.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-489: Active Debug Code
    <br />**OWASP**: <br />- A05:2021 - Security Misconfiguration
  </Accordion>

  <Accordion title="laravel-sql-injection">
    Detected a SQL query based on user input. This could lead to SQL injection, which could potentially result in sensitive data being exfiltrated by attackers. Instead, use parameterized queries and prepared statements.<br />**Likelihood**: HIGH<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    <br />**OWASP**: <br />- A01:2017 - Injection
    <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="laravel-blade-form-missing-csrf">
    Detected a form executing a state-changing HTTP method `$METHOD` to route definition `$...ROUTE` without a Laravel CSRF decorator or explicit CSRF token implementation. If this form modifies sensitive state this will open your application to Cross-Site Request Forgery (CSRF) attacks.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-352: Cross-Site Request Forgery (CSRF)
    <br />**OWASP**: <br />- A01:2021 - Broken Access Control
  </Accordion>

  <Accordion title="laravel-api-route-sql-injection">
    HTTP method \[$METHOD] to Laravel route $ROUTE\_NAME is vulnerable to SQL injection via string concatenation or unsafe interpolation.<br />**Likelihood**: HIGH<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
    <br />**OWASP**: <br />- A01:2017 - Injection
    <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="laravel-cookie-http-only">
    Found a configuration file where the HttpOnly attribute is not set to true. Setting `http_only` to true makes sure that your cookies are inaccessible from Javascript, which mitigates XSS attacks. Instead, set the 'http\_only' like so: `http_only` => true <br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag
    <br />**OWASP**: <br />- A05:2021 - Security Misconfiguration
  </Accordion>

  <Accordion title="laravel-cookie-secure-set">
    Found a configuration file where the secure attribute is not set to 'true'. Setting 'secure' to 'true' prevents the client from transmitting the cookie over unencrypted channels and therefore prevents cookies from being stolen through man in the middle attacks. <br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
    <br />**OWASP**: <br />- A05:2021 - Security Misconfiguration
  </Accordion>
</AccordionGroup>