1. Cek image permission in controller
grep -rn "'image'\|\"image\"\|image|" app/Http/Controllers/ | grep -v "mimes:" | grep -v "\.bak"
2. Cek proteksi terhadap file yang SUDAH TERLANJUR ter-upload sebelum fix
find storage/app/public -iname "*.svg" -o -iname "*.html" -o -iname "*.htm" -o -iname "*.php*"
find public -iname "*.svg" -o -iname "*.html" -o -iname "*.htm" -o -iname "*.php*"
3. Otorisasi / IDOR — belum kita audit sama sekali
grep -rn "function show\|function edit\|function update\|function destroy" app/Http/Controllers/*.php app/Http/Controllers*.php
4. Middleware & Route protection
cat routes/web.php | grep -A2 "Route::" | grep -i "admin\|middleware"
5. Mass assignment
grep -rn "fillable" app/Models/*.php
6. Dependency vulnerabilities
composer audit
npm audit
7. Rate limiting untuk login & endpoint publik
grep -n "throttle" routes/web.php routes/api.php
grep -rn "::create(\$request->all())\|->update(\$request->all())\|->fill(\$request->all())" app/Http/Controllers/