Laravel Laravel Package

Product Decisions This Supports

• Build vs. buy for "production readiness": Instead of maintaining an internal launch checklist (spreadsheet + senior-engineer review time), this package encodes those checks as configurable, severity-scored assertions (High, Warning) that run in code. Each release like v1.20.0 is maintenance you don't pay for — and this one is almost entirely correctness work on checks you'd otherwise have to re-verify by hand.
• Observability vendor selection: Because DetectsErrorTracking recognizes Flare, Inspector, and Nightwatch alongside the previously supported trackers, the choice of error-tracking vendor is no longer a hidden constraint on your readiness gate. v1.20.0 strengthens this specifically for Nightwatch: its flags are now read from the process environment, not only .env, so containerized, Kubernetes, and CI-injected configurations are evaluated the way production actually runs.
• Go-live and pre-deploy gates (roadmap-level): Two false-confidence bugs are now closed, which is the single biggest input to whether this can be a blocking gate rather than an advisory report. xss-vulnerabilities previously passed when its CSP check couldn't reach the origin; it now warns. phpstan previously ran at level 5 even when you configured 'max'; it now passes 'max' through. A silently-weaker static analysis run is exactly the kind of green-but-wrong result that erodes trust in a gate.
• CDN / asset pipeline and auth-proxy decisions: xss-vulnerabilities no longer grades the CSP of an off-host redirect (e.g. a Cloudflare Access login page), and OriginReachabilityChecker::probeFollowingSameHost() now follows same-host redirects and returns a RedirectChain. For teams fronted by SSO/Zero-Trust proxies, this is the difference between a check that's usable in your topology and one you'd have to mute.
• Alert-fatigue and severity policy: debug-mode no longer flags print_r() / var_export() unless output is actually printed, and never flags debug_backtrace(). Combined with the v1.19.0 asset-fetch downgrade, this confirms the maintainers are calibrating severity and precision, not just adding checks — grounds to treat the severity model as a real policy input.
• Environment/test-fixture correctness: config-outside-config now counts an environment marker only in a subdomain (so dev.to is no longer a false positive) and correctly reports reserved .test, .localhost, and .local hosts. This matters for teams running multi-tenant, multi-region, or staging/locale-specific configurations through the same checklist.
• Use cases to fund: onboarding audits of inherited/legacy Laravel apps, agency client handovers, technical due diligence before acquisition, and deployment matrices where the same checklist must run across many configurations and behind proxies.
• Upgrade decision: v1.20.0 is additive and corrective with no breaking changes — a low-risk minor bump that can ride along with normal maintenance. Prioritize it if you already have phpstan, xss-vulnerabilities, or missing-error-tracking in a blocking position, since those three are the ones whose results change.

When to Consider This Package

Adopt when:

• You ship a Laravel app to production and don't have a dedicated platform/SRE function owning configuration hygiene.
• You want machine-readable, CI-enforceable checks rather than a human checklist.
• You run multiple environments, or assets/URLs from a CDN, mix, or separate asset host, or sit behind an SSO/access proxy that redirects off-host.
• You inject configuration via the process environment (containers, orchestration, CI secrets) rather than a static .env.
• You need an opinionated baseline fast — e.g., due diligence, client handover, or auditing an acquired codebase.

Look elsewhere when:

• You need runtime error aggregation or tracing — that's the error-tracking vendor's job (Sentry, Flare, Inspector, Nightwatch); this package only verifies that one is wired up.
• You need general APM, log aggregation, or uptime monitoring; this is a configuration/readiness auditor, not an observability platform.
• You're not on Laravel, or you're on an unsupported Laravel/PHP version — verify compatibility before committing.
• You already run mature policy-as-code or cloud security posture tooling and don't want a second, overlapping opinionated ruleset.
• Your team cannot accept the maintainers' severity judgments as authoritative; the value depends on treating results as a real gate. Also note the checker's accuracy is bounded by its package list and its probing assumptions — niche or in-house trackers may be invisible, and origin-dependent checks (CSP, asset headers) degrade to warnings when your topology blocks them.

How to Pitch It (Stakeholders)

For executives: This is inexpensive insurance at the go-live boundary. Misconfiguration — debug mode left on, no cache headers on assets, production shipping with no error tracking, a static analysis baseline that isn't actually being enforced — is a recurring, expensive, and entirely avoidable class of incident. The package turns "did someone remember to check this?" into an automated, auditable gate. v1.20.0 is a quality release: it removes green-but-wrong results (the CSP check no longer passes when it can't reach your origin, and phpstan now honors your configured maximum level instead of quietly running weaker), it validates error tracking correctly when config comes from the process environment, and it eliminates a set of noisy false positives. No breaking changes, so adoption cost is a minor version bump; the payoff is a gate whose green actually means something.

For engineering: Composer-installable, config-driven, runs locally and in CI, emits severity-scored results you can wire into your pipeline. This release materially changes three checks: missing-error-tracking reads Nightwatch flags from the process environment (not just .env), xss-vulnerabilities ignores the CSP of off-host redirects and warns rather than passes when the origin is unreachable, and phpstan passes 'max' through instead of silently running at level 5 (it also explains unsupported levels before starting). debug-mode stops flagging print_r()/var_export() unless output is printed and never flags debug_backtrace(), and config-outside-config tightens TLD/subdomain detection. New API surface: OriginReachabilityChecker::probeFollowingSameHost() follows same-host redirects and returns a RedirectChain. Re-run your baseline before promoting any of these to blocking — expect previously green checks to flip. Caveat unchanged: severity thresholds are the maintainers' opinions; tune them against your own on-call tolerance.