Detect security vulnerabilities in your Laravel application - exposed .env files, debug mode, SQL injection indicators, and misconfigured CORS or session cookies.
No installation · No credit card required · Results in 5 minutes
What we check
Why Laravel Security Scanner
An exposed .env file is the classic Laravel misconfiguration, and it's usually one request away: if the web server serves the project root as static files instead of only the public/ directory, /.env returns plain text containing the database password, APP_KEY, mail credentials, and every third-party API key the application uses, all in a single response.
APP_DEBUG=true is the second recurring issue - it's the local development default, and when it survives into production, an unhandled exception renders a full Whoops stack trace including file paths, environment values, and the exact query that failed. Laravel Telescope, a debugging panel that logs every request, query, and exception, causes the same problem if its route ever ships enabled on a production deployment.
Laravel's Artisan commands and config caching help at the code level, but none of them tell you what a request from outside actually receives. Session cookie flags, CORS headers, and whether debug mode is really off in the live environment (not just in the .env file on disk) are only verifiable by making the same request an attacker would.
How it works
Create a free account and enter your site's URL. No installation or configuration needed.
Shieldome performs passive checks across 100+ security and performance vectors in minutes.
Get a detailed findings report with severity ratings and copy-paste remediation guidance. Export as PDF, JSON, SARIF, or CSV.
Join thousands of developers and security teams who use Shieldome to keep their sites safe.
First scan is free - no credit card required.
Free Security Tools - No Login Required