---
name: security-laravel-authorization-mass-assignment
description: Prevents users from reaching others' data or escalating roles without authorisation.
license: CC0-1.0
source: "https://github.com/diba7star/awesome-persian-prompts/blob/main/prompts/code.json"
via: "https://di9.ir/blog/en/prompts/security-laravel-authorization-mass-assignment"
---

Review this Laravel code for access control: [controller, model, and routes code]. Look for IDOR (accessing others' records by changing the id), missing Policies or Gates, empty $guarded or request()->all() in create and update, fillable sensitive fields like is_admin, and routes without middleware. Give a fix for each.