Laravel code audit
We audit Laravel apps, often inherited, rushed to launch, or partly written by AI, with a checklist written for Laravel and PHP. We tell you in plain English which problems matter and what to fix first.
Every Laravel audit covers the eight areas in every code audit, plus checks written for Laravel and PHP.
Routes and controller actions with no policy or gate behind them, record lookups that aren’t scoped to the signed-in user, and admin areas protected by a login alone.
An APP_KEY committed to the repo or shared between environments, debug mode left on in production, and Telescope, Horizon, or Debugbar reachable by the public.
Mass assignment through $guarded and $request->all(), raw SQL built from input, unescaped Blade output, Livewire state users can change, and file uploads.
Uniqueness enforced only in validation, missing foreign keys, race conditions in billing code, and queued jobs that run twice or fire before the transaction commits.
N+1 queries and lazy loading, Model::all() on large tables, config and route caching, sync queues in production, and workers that keep running old code after a deploy.
Whether your Laravel and PHP versions still get security fixes, Livewire and Filament versions with known advisories, and the packages that will block the next upgrade.
Every audit runs osv-scanner, Trivy, and Semgrep against your code, but scanners only find the patterns they know. The findings that hurt most in Laravel apps are usually ones a scanner can’t see:
Model::find($request->id) with no policy checkThose come from reading the code with a checklist built around how Laravel apps actually get attacked and how they fail in production.
Three levels, each a fixed fee. Essentials covers the most important Laravel checks; Standard and Comprehensive cover all of them. See everything every audit includes.
A fast health check
$1,000 fixed fee
Best for: Answering "is this codebase OK?" before you buy, hire, or launch.
A thorough review
$1,500 fixed fee
Best for: An inherited codebase, a pre-launch review, or before hiring a team.
Everything in Essentials, plus:
Due diligence depth
$2,500 fixed fee
Best for: Acquisitions and technical due diligence, compliance preparation, or after an incident.
Everything in Standard, plus:
Laravel gives each major version 18 months of bug fixes and two years of security fixes, and PHP supports each release for four years. Many apps run a Laravel or PHP version that no longer gets security fixes. Every Laravel audit checks both against the official support policies.
If you’re behind, the report lays out the upgrade one version at a time, and Standard and Comprehensive also list the packages and deprecations that stand in the way. When you’re ready, we can do the upgrade too.
Checked November 13, 2026 against the Laravel support policy.
Every code audit covers the eight areas on our code audit page. These have their own checklists too.
The same fixed fees as every audit: $1,000 for Essentials, $1,500 for Standard, and $2,500 for Comprehensive. Compare the levels. Hire us for hourly development within 30 days of your report and up to $1,000 of the fee comes off your first invoice.
Yes. Every Laravel code audit includes a security audit: data access, admin areas, keys and secrets, debug tooling, sessions, injection, and file uploads, checked against the known weaknesses of Laravel and PHP, plus dependency and code scans.
Any of them, from apps stuck on an old major to apps on the latest release. If you’re behind, the report says how far and lays out the upgrade one version at a time; Standard and Comprehensive also list the packages that stand in the way.
Yes. Livewire components, Inertia props, and Filament admin panels each get their own checks, since they’re where Laravel apps most often expose data or state they shouldn’t. API-only apps using Sanctum or Passport get the same review.
Essentials reviews the code without running it. Standard and Comprehensive boot your app and run your tests in an isolated, disposable environment. Either way, we never connect to your production servers, databases, or accounts.
Yes. We can work alongside your team or take it on ourselves, and the audit credit applies.
Tell us about your Laravel app and we'll recommend the level that fits.