Security
Publicly discoverable, controlled by policy.
The public site is a presentation surface. Private data, actions and resources remain protected through server-side enforcement.A security foundation, not a certification
The starter includes useful mechanisms, but every project must assess its risks, infrastructure, processes and legal obligations.
Identity and authorization
Access is decided using identity, verification and permissions.
Authentication
Registration, email verification, password reset and password change flows.
Roles and permissions
Spatie permissions and dedicated policies for domain actions.
Resource access
Restricted channels and content are checked in the API, not only in the interface.
Data and content
Public visibility must not expose internal metadata.
Private attachments
Sensitive files are served through authorized endpoints.
Minimal payload
Public resources should exclude email, permissions and operational metadata.
Privacy by route
Social profiles and posts are public only when visibility settings allow it.
Responsible operations
Security continues into infrastructure and process.
Audit logs
Important actions can be investigated and linked to affected resources.
Rate limiting
Sensitive flows and repetitive actions can be limited independently.
Project responsibility
Backup, patching, monitoring, secrets and incident response are configured at deployment.
Have a specific security requirement?
Document the context, data and risk before choosing final configuration.