Laravel Security Laravel Package

Breaking

• Composer package renamed from make-dev/security to make-dev/laravel-security. The PHP namespace is unchanged (MakeDev\Security) so application code (use statements, app(\MakeDev\Security\…)::class references, service-provider entries) is unaffected. Update the require entry in your composer.json and reinstall:

  composer remove make-dev/security
  composer require make-dev/laravel-security
  

  The vendor:publish tag also moves from make-dev-security to make-dev-laravel-security.

Changed

• Marketing-forward composer.json description and broader keyword set so the package surfaces on Packagist searches for Filament, Livewire, Vite, Vapor, Strict CSP, nonce, and XSS protection.

Upgrade path from v0.1.0

composer remove make-dev/security
composer require make-dev/laravel-security

No code changes needed.

Initial release.

A drop-in security headers package for Laravel covering HSTS, CSP, X-Content-Type-Options, Permissions-Policy, and Subresource Integrity, plus first-party endpoints for receiving CSP and SRI violation reports.

Highlights

• Strict CSP by default — per-request nonce + 'strict-dynamic', [@cspNonce](https://github.com/cspNonce) Blade directive, and optional auto-injection on every <script> tag (catches CMS-rendered raw HTML without per-template plumbing).
• Subresource Integrity — host allowlist + skip-pattern list, observer scoped to data-sri-managed tags so third-party SRI noise stays out of reports.
• Multi-host asset_domain — string, comma-separated env, or array; auto-appended to script-src / style-src / img-src / font-src / connect-src / media-src.
• Vapor-friendly two-stage SRI build/warm flow.
• Interactive setup wizard (php artisan security:install) with curated CSP presets for GTM, Google Maps, HubSpot, LinkedIn, Stripe, reCAPTCHA, Sentry, Intercom, and more.
• Built-in /csp-report and /sri-report endpoints with optional database persistence and defense-in-depth host filtering.

Requirements

• PHP 8.2 – 8.5
• Laravel 11, 12, or 13

Install

```bash composer require make-dev/laravel-security php artisan security:install ```

PHP namespace is MakeDev\Security. See the README for the full feature tour.