OWASP Top 10 2021: A05–A08 with Examples

<?php
// A05: Security Misconfiguration — disable debug mode and verbose errors in production

// config/app.php — driven by environment variable
return [
    'debug' => (bool) env('APP_DEBUG', false),  // NEVER true in production
    'env'   => env('APP_ENV', 'production'),
];

// .env.production — never commit this file
// APP_DEBUG=false
// APP_ENV=production

// Custom exception handler: safe error responses (no stack traces)
// app/Exceptions/Handler.php
public function render($request, Throwable $e): Response
{
    if ($request->expectsJson()) {
        $status  = method_exists($e, 'getStatusCode') ? $e->getStatusCode() : 500;
        $message = app()->isProduction() ? 'An error occurred.' : $e->getMessage();
        return response()->json(['error' => $message], $status);
    }
    return parent::render($request, $e);
}

// A08: Unsafe deserialisation — never unserialize untrusted data
// DANGEROUS:
// $userData = unserialize($_COOKIE['user_data']);  // BAD — PHP Object Injection

// SAFE: use JSON
$userData = json_decode(base64_decode($_COOKIE['user_data'] ?? ''), true);
if (!is_array($userData)) {
    $userData = [];
}

// A06: Dependency scanning in composer.json scripts
// "scripts": {
//     "audit": "composer audit",
//     "security-check": "vendor/bin/security-checker security:check"
// }