Security context

Highlights

Auth Bypass: 3 prior fixes. Scrutinize any change in this area.

src/Checkers/User/UserDefaultChecker.php: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: Revoked roles and permissions can persist within the same execution thread because stale Eloquent in-memory relations are not automatically invalidated when role mappings change. Developers must manually unset these relations to prevent privilege persistence.

Auth Bypass: Failing to register permission-checking directly into Laravel's native Gate before-hook allows users to bypass standard Laravel policy checks that expect Laratrust permissions to be integrated natively.

Auth Bypass: Missing server-side restriction checks on sensitive administrative roles in the Laratrust UI allow unauthorized modifications or deletions of critical roles, leading to privilege escalation.