SEC-029
Laravel debug tools or logs are public
HighDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
Laravel Ignition, Telescope and storage/logs/laravel.log.
Why it matters
Logs and debug dashboards contain stack traces, SQL, request data and sometimes credentials; old Ignition versions allow remote code execution.
Recommended fix
Set APP_DEBUG=false in production, block /storage from the web root, and restrict Telescope to admins.
How to verify
Request each listed path on the live site and confirm it returns 404 or 403.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-029: Laravel debug tools or logs are public
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Harden the Laravel production config: APP_DEBUG=false, make sure only /public is the web root (storage/logs must not be reachable), and gate Telescope behind authentication. Upgrade facade/ignition if it is older than 2.5.2.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Request each listed path on the live site and confirm it returns 404 or 403.