Common vulnerabilities we find in client code

Security audits tend to turn up the same handful of issues again and again, regardless of framework or team size. Mass assignment vulnerabilities from unguarded Eloquent models are near the top of the list — a model without a properly defined $fillable or $guarded property is an open invitation for unexpected data to be written during a form submission.

Second most common: missing authorization checks on routes that rely purely on authentication middleware. Being logged in is not the same as being allowed to view a specific resource, and it is easy to forget a policy check on a "just one more admin route" that gets added under deadline pressure.

We also regularly find outdated dependencies with known CVEs, secrets committed to version control at some point in a project's history, and file upload handling that does not validate MIME types server-side.

None of these require exotic tooling to catch — a disciplined code review checklist and routine dependency scanning would have caught the majority of what we find in audits.