High severityPHPHardcoded SecretsHIGH confidence

Laravel App Key Literal

The Laravel application encryption key (APP_KEY) is hardcoded as a literal instead of read from the environment (CWE-798/CWE-321).

Standards mapping

CWE: CWE-321: Use of Hard-coded Cryptographic Key CWE-798: Use of Hard-coded Credentials
OWASP Top 10: A02:2021 - Cryptographic Failures
OWASP ASVS: V6.4.1 (L2)

Vulnerable vs. safe

Flagged by this check

$config = ['name' => 'app', 'key' => 'base64:kJf8s9dhajksdhakjsdhaksjdhKKKmm=', 'debug' => false];

Passes - the safe pattern

$config = ['name' => 'app', 'key' => env('APP_KEY')];

Why it matters & how to fix it

The Laravel application encryption key (APP_KEY) is hardcoded as a literal instead of read from the environment (CWE-798/CWE-321). This key protects all encrypted values, signed cookies, and sessions. Use 'key' => env('APP_KEY') and store the value only in the .env file, then rotate the exposed key.

References

Rule ID integsec-php-laravel-app-key-literal - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.

TurboPentest runs this check automatically

Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.

Start a pentest

Related checks