Laravel AI Security Masterclass
Production-tested playbooks, concrete threat models, and runnable hardened PHP 8.4 & Laravel 13 code. Designed for developers building high-stakes web applications and enterprise AI systems.
Track 01 Modules
Secure Coding Basics
Fundamental security principles, defense-in-depth, least privilege, and secure SDLC in PHP.
PHP 8.4 Security Features
Modern PHP 8.4 security: readonly classes, typed properties, Fibers, and memory safety.
Laravel 13 Architecture Security
Laravel 13 security pipeline, bootstrap/app.php middleware, Precognition, and Reverb channels.
Track 02 Modules
Password Handling & Passkeys
NIST SP 800-63B standards, Argon2id parameters, and passwordless FIDO2 WebAuthn Passkeys.
Session Security & Fixation Defense
Session fixation mitigation, secure cookie flags, session hijacking defense, and Redis storage.
Track 03 Modules
Input Handling & Sanitization
Zero-trust input filtering, strict FormRequest validation rules, and UTF-8 normalization.
SQL Injection Prevention
Defeating SQL injection with Eloquent query bindings, safe whereRaw, and PDO parameterization.
Cross-Site Scripting (XSS) Defense
Blade automatic HTML-escaping, innerHTML hazards, context-aware escaping, and DOM sanitization.
CSRF Protection & SameSite Cookies
Synchronizer tokens, AJAX CSRF headers, SameSite cookie mechanics, and webhook exemptions.
Secure File Uploads
MIME verification, polyglot file detection, private cloud disk storage, and filename hashing.
Track 04 Modules
API Security & OWASP API Top 10
Sanctum 4.x token authorization, BOLA/IDOR prevention, rate limiting, and mass assignment.
Common API Exploits & SSRF
Deep dive into broken authentication, SSRF allowlisting, and unrestricted resource consumption.
Track 05 Modules
Prompt Injection Defense
Direct & indirect prompt injection defense, system/user role separation, and boundary nonces.
LLM API Key & Cost Security
API key protection, Redis sliding-window token budgets, and Denial of Wallet mitigation.
RAG Multi-Tenant Isolation
Vector database tenant filtering with pgvector and Eloquent access controls.
Agent Tool Sandboxing
Autonomous agent tool allowlists, Laravel Gate policies, and human approval gates.
PII Redaction Pipeline
Reversible tokenization for Saudi National IDs, emails, phones, and Saudi PDPL compliance.
Model Output Validation
Treating model outputs as untrusted: JSON schema validation and second-order injection defense.
Track 06 Modules
Secure Configuration & Environment
Environment variable protection, OPcache tuning, debug mode risks, and secret vaults.
Security Headers & CSP Nonces
Content Security Policy with nonces, HSTS preloading, COOP, COEP, and modern headers.
Secure Server Deployment & TLS 1.3
TLS 1.3 ciphers, ECDSA P-256 / RSA 4096 keys, Linux permissions, Fail2Ban, and firewalls.
Error Handling & Security Logging
Masking stack traces in production, structured JSON security audit trails, and SIEM alerting.