https://laravel.io/index.php/forum/feed The RSS feed for the Laravel.io forum contains a list of all threads posted by community members. 2026-09-07T21:28:58+00:00 https://laravel.io/index.php/30889

2026-09-07T21:28:58+00:00 https://laravel.io/index.php/30856

2026-09-07T21:28:58+00:00 https://laravel.io/index.php/30886

2026-09-07T21:28:58+00:00 https://laravel.io/index.php/30885

2026-09-07T21:28:58+00:00 https://laravel.io/index.php/30884

2026-09-07T21:28:58+00:00 https://laravel.io/index.php/30883

2026-09-07T21:28:58+00:00 https://laravel.io/index.php/30881

2026-09-07T21:28:58+00:00 https://laravel.io/index.php/30880

2026-09-07T21:28:58+00:00 https://laravel.io/index.php/30878

2026-09-07T21:28:58+00:00 https://laravel.io/index.php/30875

2026-09-07T21:28:58+00:00 https://laravel.io/index.php/30877

2026-09-07T21:28:58+00:00 https://laravel.io/index.php/30876

2026-09-07T21:28:58+00:00 https://laravel.io/index.php/30873

2026-09-07T21:28:58+00:00 https://laravel.io/index.php/30872

[ 'token' => env('ACME_TOKEN'), ], ]; ``` Application code should then read it through Laravel's configuration repository: ```php $token = config('services.acme.token'); ``` I also test deployment builds with configuration cached. That catches the direct-access problem before production. ## Environment-file drift remains A related issue is keeping the key inventories of `.env`, `.env.testing`, `.env.production`, `.env.sample`, or renamed templates aligned without comparing or exposing their values. Some practical questions for teams maintaining several environments: - Do you treat every `.env.*` file as a complete contract, or are some of them partial Vite-style layers? - How do you detect a key used by application code but declared nowhere? - How do you handle keys consumed only by Docker, CI, a process manager, or hosting infrastructure without producing false positives? - Do commented assignments in non-active templates count as documented optional keys in your workflow? - Do you audit raw `getenv()`, `$_ENV`, `$_SERVER`, Vite, Blade, and PHPUnit usage as part of the same review? ## An optional development guard While working through these cases, I built the open-source [Laravel Env Guard](https://github.com/Codegenie-BE/laravel-env-guard): ```bash composer require --dev codegenie-be/laravel-env-guard ``` It runs during guarded Artisan boots in the local environment by default. It checks unsafe `env()` usage and environment-key drift, but reports keys only: no values, telemetry, network calls, automatic `.env` changes, or production scanning by default. The current release supports Laravel 12 and 13 across their valid PHP 8.2–8.5 combinations. Disclosure: I maintain this package through Codegenie. I am looking for technical feedback about real-world environment-file conventions and false-positive or false-negative cases, not stars. Please do not share real environment values or secrets.]]>

2026-09-07T21:28:58+00:00 https://laravel.io/index.php/30871

$user->id, 'processor_token' => $charge->id, // e.g. Stripe charge/payment intent ID 'amount' => $amount, 'status' => 'pending', ]); ``` **2. Enforce Idempotency on Every Write Endpoint** Network retries, double-taps on the frontend, and queue redelivery can all cause the same charge or transfer request to hit your API twice. Require an Idempotency-Key header and store a hash of processed keys so a repeated request returns the original result instead of creating a duplicate transaction. ``` php if (Cache::has("idempotency:{$key}")) { return Cache::get("idempotency:{$key}"); } ``` Laravel doesn't do this for you out of the box, so it's worth building as reusable middleware if you're handling any kind of money movement. **3. Use Database Transactions + Locking for Balance Updates** Never do a read-then-write balance update without locking the row. Race conditions here are exactly how double-spends happen. ``` php DB::transaction(function () use ($walletId, $amount) { $wallet = Wallet::where('id', $walletId)->lockForUpdate()->first(); if ($wallet->balance < $amount) { throw new InsufficientFundsException(); } $wallet->decrement('balance', $amount); }); ``` **4. Rate Limit Aggressively on Financial Endpoints** Laravel's built-in throttle middleware is a good start, but for payment endpoints specifically, consider tighter limits and per-user (not just per-IP) throttling to blunt card-testing and enumeration attacks. ``` php Route::middleware('throttle:10,1')->group(function () { Route::post('/payments/charge', [PaymentController::class, 'charge']); }); ``` **5. Verify Webhooks Cryptographically** If you're consuming webhooks from a payment processor, always verify the signature before trusting the payload. Don't just check that the request "looks right." ``` php $sig = $request->header('Stripe-Signature'); $event = \Stripe\Webhook::constructEvent($payload, $sig, config('services.stripe.webhook_secret')); ``` **6. Log Everything, But Never Log Sensitive Data** Full audit trails matter a lot for financial systems — who initiated a transaction, when, from where. Just make sure your logging channel scrubs card numbers, tokens, and auth headers before anything hits disk. **7. Use Policies/Gates for Every Financial Action** Don't rely on route middleware alone. Wrap every transfer, withdrawal, or balance-changing action in an explicit authorization check via Laravel's Policy classes, so it's obvious and testable that a user can only act on their own wallet/account. None of this is Laravel-specific in principle — it's standard fintech engineering discipline — but Laravel gives you solid primitives (transactions, middleware, policies, queues) to implement it cleanly if you use them deliberately rather than bolting security on after the fact. At Nimble AppGenie we've run into a lot of these issues while working on [fintech APIs](https://www.nimbleappgenie.com/blogs/top-fintech-apis-for-every-startup/) for wallet and payment products, and idempotency + row locking are consistently where teams get bitten first. What are others doing for fraud detection or velocity checks at the API layer? That's the piece I'm still refining.]]>

2026-09-07T21:28:58+00:00 https://laravel.io/index.php/30869

2026-09-07T21:28:58+00:00 https://laravel.io/index.php/30868

2026-09-07T21:28:58+00:00 https://laravel.io/index.php/30867

2026-09-07T21:28:58+00:00 https://laravel.io/index.php/30866

2026-09-07T21:28:58+00:00 https://laravel.io/index.php/30863

workflow('summary') ->rawPrompt('Summarize the latest customer feedback.') ->build(); $run = $rick->run($workflow); echo $run->output(); Installation: composer require rickphp/laravel-rick:^0.1 php artisan migrate ## What it currently supports - synchronous and queued workflow execution; - Laravel AI provider calls; - parallel operations with deterministic result ordering; - manual review, candidate selection and external input; - encrypted, tenant-scoped persistence; - pricing and resource budgets; - run metrics, snapshots and timelines; - transactional outbox delivery; - recovery of interrupted runs; - protection against blindly repeating ambiguous paid requests. One of the included examples generates five independent implementation plans, persists all five candidates, pauses the workflow for human review and continues only after the application selects a candidate. Another example dispatches independent operations through Laravel queues. Results are reduced in declaration order even if workers complete them in a different order. Duplicate delivery of an already completed invocation does not trigger another provider call. Laravel Rick 0.1.0 supports PHP 8.3+ and Laravel 12–13. It is open source under the MIT license. This is the first public release, so the API may still evolve before 1.0. I would especially appreciate feedback on: 1. Is the workflow-building API understandable? 2. Which real Laravel AI workflow would you try to implement with it? 3. What is missing from the installation or use-case documentation? GitHub: https://github.com/para1992/laravel-rick Packagist: https://packagist.org/packages/rickphp/laravel-rick Release: https://github.com/para1992/laravel-rick/releases/tag/v0.1.0 Issues and feature requests: https://github.com/para1992/laravel-rick/issues/new/choose]]>

2026-09-07T21:28:58+00:00