Your Laravel controller, audited the way an attacker reads it

Paste the controller, the routes that reach it, the models it writes and its form requests. A real reader of Laravel runs first in your browser.

Both examples ship with saved runs of both lanes, so you can see the audit and the pinning tests end to end without signing in and without spending a credit.

Your Laravel code — controller, routes, models, form requests, views nothing pasted yet

Drag .php, .blade.php or .env files in, or or an app/ folder Everything is read in your browser. Nothing uploads until you run a lane.

Laravel version

Auth stack

Tests in

Context — optional, but it changes the ranking

Paste some Laravel code to price the run.

lane

verdict

routes

controllers

models

critical + high

Metrics

Measure	Value	Target	Status	Note

Attack surface

One row per route, with the middleware of every group around it. Route-model binding loads a row by id; it does not check who owns it.

Route	Action	Middleware	Authorization	Validation	Risk

Mass assignment

Model	Protection	Exposed columns	Reached from

OWASP Top 10 (2021)

Category	Status	Evidence

Test plan

A test that pins a finding fails on the pasted code and passes once the fix lands. Every test here is checked against the generated file below.

Findings pinned

Factories the tests need

Model	States	Note

Run with php artisan test

Findings

The test file

Prescan reconciliation

Every flag the browser raised, and what the model did with it. A flag the model never mentioned is named here rather than quietly dropped.

Next steps

Summary

Raw model reply

The reply did not parse as the structured review, so it is shown as it arrived.

What this does, and what it does not

The prescan is a real reader of Laravel code, not a keyword search. Comments are masked, and string literals are masked in a second copy, so a brace inside a string never unbalances a method and the word delete in a comment is not counted as a write. Every route is resolved to its controller action and to the middleware of every Route::middleware(...)->group() around it, so "behind auth" is a fact about the source rather than a guess. Every model's $fillable, $guarded, $hidden and casts are read, every FormRequest's authorize() is classified as always-true or real logic, and every raw query is checked for values spliced into the SQL string.

The pinning tests are the point of the second lane. A finding you cannot prove fixed tends to come back; a test that fails on today's code and passes once the fix lands is the proof and the guard. The generated file is read back by the same prescan, and every planned test is matched against it, so a plan that names a test the file never defines is called out.

It reads; it never boots your application, never runs php artisan, never executes a test and never sends a request to your site. A key or password you paste is a value you should rotate: the review is told to say where it is rather than repeat it.

Nothing to hand? Load , with an interpolated search query, $request->all() into a model with $guarded = [] and a delete route on GET, or , with FormRequests and a policy but one download action that serves any customer's PDF. Both replay saved runs for free.