Think Like an Adversary: OPSEC for Laravel Developers
summary
A practical checklist for Laravel apps that focuses on real vectors: use Composer Audit and Snook (and Dependabot) in CI to catch supply‑chain risks, rotate secrets quarterly and move them to a vault instead of Slack, scope CI/CD tokens and deploy keys, and run 15‑minute quarterly access reviews. Adopt three clearance levels (public, internal, critical), run tabletop incident exercises, and segment deploy/payment access so a single phishing click reduces the blast radius rather than exposing everything.
AI-written summary · about
chapters (17)
- 0:00Introduction and speaker background
- 1:58Beyond code security basics
- 3:10Two core jobs of OPSEC
- 3:34Laravel security surface checklist
- 6:17Organizational layer and threat modeling
- 8:11Threat modeling in practice
- 10:14Clearance levels and need-to-know
- 11:53Access control and blast radius
- 13:27Social engineering risks
- 14:37Incident response planning
- 15:47Vendor trust and third-party risk
- 16:55Security tradeoffs and intentionality
- 17:19Practical takeaways for solo founders
- 18:28Enterprise scale security measures
- 19:16Red flags in security practices
- 20:25Summary and final advice
- 21:13Q&A session
related talks
59mEasily Digestible Security Pills
52mPractical Security in Web Applications
30mThink Like a Hacker
28mDefending the Hornburg
31mHow your Laravel application can get hacked, and how to prevent that from happening
38mPrioritizing Trust While Creating Applications
01h 01mSecurity: From basic principles to PHP specifics
33mLearning from Past Security Breaches: Strengthening AppSec Efforts and Focus