Security#
This page states WELD's security practices, one per heading, each with the rule and the tag that shows whether the stack holds it today.
W25: Keep the framework above the published security floor#
Practice: Require laravel/framework at or above the latest patched release, run composer audit in CI, and let CREED's policy.json name the minimum patch level. A critical TokenGuard authentication bypass was published on 2026-10-19 (fixed in 13.29.0 and 12.68.0).
Stack: Checked. composer.json pins laravel/framework: ^13.29 (at or above the patched release), composer.json runs @composer audit inside the ci script, and .gitlab-ci.yml includes the Preflight composer-audit component, so the audit runs in CI. CREED's policy.json is a dependency and PROCTOR measures against it, now also inside the test suite (tests/Feature/ProctorCheckTest.php).
W26: Debug is off outside local#
Practice: APP_DEBUG=false in production. The debug page has had an XSS advisory (Low, 2026-09-10).
Stack: Not yet. .env.example sets APP_DEBUG=true for the local default, and there is no boot assertion that fails when APP_ENV=production and APP_DEBUG=true. Target Enforced: a boot assertion fails when APP_ENV=production and APP_DEBUG=true.
W27: CSRF uses the PreventRequestForgery middleware#
Practice: Laravel 13 formalized request-forgery protection as PreventRequestForgery (origin-aware, still token-compatible). Any custom middleware stack or HELMET code must reference the new name.
Stack: Documented. bootstrap/app.php appends to the default web middleware group, which carries PreventRequestForgery in Laravel 13, so the protection is in place by default. There is no feature test that posts without a token and expects 419. Target Checked: a feature test posts without a token and expects 419.
W28: CSP works with Inertia 3 and Vite#
Practice: HELMET sets the CSP header and calls Vite::useCspNonce(); Laravel then adds the nonce to the tags @vite emits. Inertia 3 puts initial page data in a JSON script element. Run the policy in report-only first.
Stack: Documented. HELMET ^0.3 is a dependency and its security headers and CSP middleware run in the global chain. Target Checked: a browser test under an enforced CSP.
W29: Agent tooling stays out of production#
Practice: Laravel Boost is require-dev. Its MCP server can write rules to disk and run database queries; its docs tool sends queries to a hosted service. Production images are built with composer install --no-dev; guard any post-update-cmd that calls boost:update.
Stack: Not yet. Boost is not a dependency yet. Target Checked: the portability job fails when vendor/laravel/boost exists in the image.