Laravel

A `laravel_session` or `XSRF-TOKEN` cookie — weight 75, enough on its own for a high-confidence report.

A build asset path of the form `/build/assets/app-<hash>.js` — weight 40, which only adds to the score: Laravel's default front-end tooling produces it, and so do many non-Laravel projects.

`XSRF-TOKEN` is not exclusive to Laravel, which is why the rule reports a confidence rather than a certainty, and why a site with only that cookie is not over-claimed.

PHP itself is a separate rule and is never reported as Laravel.

Laravel stores the current CSRF token in an encrypted `XSRF-TOKEN` cookie included with each response it generates.

The documentation describes it as a developer convenience: libraries such as Axios and Angular copy its value into an `X-XSRF-TOKEN` header automatically on same-origin requests.

For that to work, script must be able to read it, so the absence of the `HttpOnly` flag on this particular cookie is intended rather than a defect.

The session cookie is a different matter, and its flags deserve the usual scrutiny.

The `debug` option in `config/app.php` follows the `APP_DEBUG` environment variable and decides how much error detail is shown to users.

The documentation is explicit: in production it should always be false, because true risks exposing sensitive configuration values to end users.

From outside, debug mode shows up only when an error happens to be triggered, as a detailed error page instead of a generic one.

An audit cannot switch it off, and it cannot prove it is off; it can report detailed errors when it meets them.

Laravel's deployment guide requires the web server to direct all requests to `public/index.php`.

Serving the application from the project root instead would, in the guide's words, expose many sensitive configuration files to the public internet — the `.env` file among them.

This is a server configuration fault rather than a Laravel one, and it is the most damaging way a Laravel deployment goes wrong.

Private keys or credentials found in served content are reported whatever the cause.

`technology.inventory` lists the detection with the cookie that produced it.

`cookies.inventory`, `cookies.secure`, `cookies.httponly` and `cookies.samesite` report the flags of the session cookie actually set.

`api.errors.disclosure` reports stack traces and internal details in error responses.

`exposure.secrets.private` reports private keys and credentials in what was served.

Laravel's session documentation lists a `cookie` driver in which sessions are stored in secure, encrypted cookies, as an alternative to server-side stores.

With that driver the whole session travels with every request, which makes cookie size and flags part of the audit rather than a detail.

The deployment guide warns that once configuration is cached with `config:cache`, the `.env` file is no longer loaded and calls to `env` outside configuration files return null.

That is a frequent cause of settings — debug mode among them — behaving differently in production from what the `.env` file suggests.

The engine reports cookie size and flags as they are actually set, whichever driver produced them.