# Laravel code audit and PHP security audit > A fixed-fee Laravel code audit and security audit. Checks written for Laravel and PHP, your versions and packages, with a plan for what to fix first. - URL: https://velocitylabs.io/code-audit/laravel/ Laravel code audit # A Laravel code audit that knows where Laravel apps break. We audit Laravel apps, often inherited, rushed to launch, or partly written by AI, with a checklist written for Laravel and PHP. We tell you in plain English which problems matter and what to fix first. ## What a Laravel code audit checks Every Laravel audit covers the eight areas in every code audit, plus checks written for Laravel and PHP. - ### Who can see whose data Routes and controller actions with no policy or gate behind them, record lookups that aren’t scoped to the signed-in user, and admin areas protected by a login alone. - ### Keys, debug mode, and dev tools An `APP_KEY` committed to the repo or shared between environments, debug mode left on in production, and Telescope, Horizon, or Debugbar reachable by the public. - ### Injection and unsafe input Mass assignment through `$guarded` and `$request->all()`, raw SQL built from input, unescaped Blade output, Livewire state users can change, and file uploads. - ### Data that holds up Uniqueness enforced only in validation, missing foreign keys, race conditions in billing code, and queued jobs that run twice or fire before the transaction commits. - ### Speed under real traffic N+1 queries and lazy loading, `Model::all()` on large tables, config and route caching, sync queues in production, and workers that keep running old code after a deploy. - ### Version and upgrade path Whether your Laravel and PHP versions still get security fixes, Livewire and Filament versions with known advisories, and the packages that will block the next upgrade. ## More than a scanner report Every audit runs osv-scanner, Trivy, and Semgrep against your code, but scanners only find the patterns they know. The findings that hurt most in Laravel apps are usually ones a scanner can’t see: - A `Model::find($request->id)` with no policy check - A Telescope gate that lets any logged-in user in - A uniqueness rule with no unique index behind it - A job that charges a customer again on every retry Those come from reading the code with a checklist built around how Laravel apps actually get attacked and how they fail in production. ## Laravel code audit pricing Three levels, each a fixed fee. Essentials covers the most important Laravel checks; Standard and Comprehensive cover all of them. [See everything every audit includes](https://velocitylabs.io/code-audit/). ### Essentials A fast health check **$1,000** fixed fee **Best for:** Answering "is this codebase OK?" before you buy, hire, or launch. - Review of your code, configuration, CI, and database schema - Automated scans for security issues, vulnerable and outdated dependencies, leaked secrets, and code quality - The essential checks for each technology in your stack - Critical and high findings written up in full ### Standard A thorough review **$1,500** fixed fee **Best for:** An inherited codebase, a pre-launch review, or before hiring a team. Everything in Essentials, plus: - Every check for each technology, not just the essentials - Your app and tests running in our isolated environment - How your team ships, when the code comes with its git history - Every finding written up in full ### Comprehensive Due diligence depth **$2,500** fixed fee **Best for:** Acquisitions and technical due diligence, compliance preparation, or after an incident. Everything in Standard, plus: - Line-by-line review of sign-in, payments, and data access - Steps to reproduce every finding - Your public website: accessibility, search visibility, and security headers - Domain and email setup: DNS, SPF, DKIM, and DMARC ## Is your Laravel version still supported? Laravel gives each major version 18 months of bug fixes and two years of security fixes, and PHP supports each release for four years. Many apps run a Laravel or PHP version that no longer gets security fixes. Every Laravel audit checks both against the official support policies. If you’re behind, the report lays out the upgrade one version at a time, and Standard and Comprehensive also list the packages and deprecations that stand in the way. When you’re ready, we can do the [upgrade](https://velocitylabs.io/maintenance/) too. _Laravel support today Latest: 13.42.0_ - Laravel 13Supported Bug fixesUntil Q3 2027 Security fixesUntil Mar 17, 2028 - Laravel 12Security only Bug fixesEnded Aug 13, 2026 Security fixesUntil Feb 24, 2027 - Laravel 11Unsupported Bug fixesEnded Sep 3, 2025 Security fixesEnded Mar 12, 2026 - Laravel 10 and olderUnsupported Bug fixesEnded by Aug 6, 2024 Security fixesEnded by Feb 4, 2025 Checked November 13, 2026 against the [Laravel support policy](https://laravel.com/docs/master/releases). ## Other stacks we audit Every code audit covers the eight areas on our [code audit page](https://velocitylabs.io/code-audit/). These have their own checklists too. - [Rails](https://velocitylabs.io/code-audit/ruby-on-rails/) - [Python](https://velocitylabs.io/code-audit/python/) - [Node.js](https://velocitylabs.io/code-audit/nodejs/) - [Mobile apps](https://velocitylabs.io/code-audit/mobile-app/) - [Shopify](https://velocitylabs.io/code-audit/shopify-app/) ## Questions about Laravel code audits #How much does a Laravel code audit cost? The same fixed fees as every audit: $1,000 for Essentials, $1,500 for Standard, and $2,500 for Comprehensive. [Compare the levels](https://velocitylabs.io/code-audit/laravel/#pricing). Hire us for hourly development within 30 days of your report and up to $1,000 of the fee comes off your first invoice. #Is a PHP security audit included? Yes. Every Laravel code audit includes a security audit: data access, admin areas, keys and secrets, debug tooling, sessions, injection, and file uploads, checked against the known weaknesses of Laravel and PHP, plus dependency and code scans. #Which versions of Laravel and PHP do you audit? Any of them, from apps stuck on an old major to apps on the latest release. If you’re behind, the report says how far and lays out the upgrade one version at a time; Standard and Comprehensive also list the packages that stand in the way. #Do you audit Livewire, Inertia, and Filament apps? Yes. Livewire components, Inertia props, and Filament admin panels each get their own checks, since they’re where Laravel apps most often expose data or state they shouldn’t. API-only apps using Sanctum or Passport get the same review. #Do you need to run our app? Essentials reviews the code without running it. Standard and Comprehensive boot your app and run your tests in an isolated, disposable environment. Either way, we never connect to your production servers, databases, or accounts. #Can you fix what the audit finds? Yes. We can work alongside your team or take it on ourselves, and the audit credit applies.