APP_DEBUG=true on a live Laravel site shows your database password and API keys on the error page, and a .env copy left in public_html is downloaded by bots within hours. This skill finds those and nine other Laravel configuration mistakes before you deploy, and tells you how to fix each one.

Your agent runs a scanner on your project: every .env file (.env, .env.production, backup copies; examples and templates are skipped) and every config/*.php file. It reads .env files the way Laravel does (quotes, export, comments, the last value wins) and reads PHP config arrays with their comments, strings and env('NAME', default) fallbacks. Local and testing environments are read but not reported. It never runs PHP or artisan. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Keys and passwords are never printed.

What it checks

BLOCK (fix before shipping)

• L01: APP_DEBUG on in production, or true as the default in config/app.php

• L02: APP_KEY that is a sample value, too short, or written into config/app.php

• L03: a password, secret or API key written into a config file or an env() default

• L04: a .env file or copy inside public/, public_html/ or another web root folder

REVIEW (check before release)

• L11: session cookie not secure, or readable by JavaScript

• L12: CORS allowing every origin with supports_credentials

• L13: Telescope or Debugbar on in production

• L14: LOG_LEVEL=debug in production

• L15: an http:// APP_URL

• L16: the root database user or an empty database password

• L17: BCRYPT_ROUNDS below 10

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example project (.env.production and config files), a .env copy in public/ to find, and the real report the scanner produces on the risky example

Limits

It reads files as written, so values from the server's real environment, config:cache and code in service providers are not seen, and it cannot see a web server whose document root is the whole project folder. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 15 files: SKILL.md, the scanner in scripts/ (2 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (10 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.