Security Guide for Extension Authors

A plugin runs with full access to the site. These are the rules the bundled modules follow, and the places where TruCMS behaves differently from a plain Laravel application.

Authorisation

Gate every route. Put a permission on the group (permission:access testimonials) and a ->can('...') on each route. A route without a check is open to every signed-in user.
Use the full admin stack.['web', 'auth', 'verified', '2fa', AdminTheme::class] gives your screens the same e-mail-verification and two-factor protection as the core admin.
Hiding is not securing. Removing a sidebar item or a button only hides it; the route still answers.
Check ownership in code. Permissions say what a role may do; they do not say which record. For visitor-owned data (a customer's bookings, a user's tickets), scope queries to $request->user() or write a policy, as the core does for teams and tickets.
Remember the super administrator passes every gate. Test with userWithPermissions(), not with a super admin, or missing checks go unnoticed.

Input

Validate in form requests, and authorise in their authorize() method too when the route is shared.
Declare $fillable on models and pass $request->validated(), never $request->all().
Use the query builder or Eloquent bindings; never concatenate request values into SQL or into orderBy() column names without an allow-list.
Add @csrf to every form that posts.
Rate-limit public forms and anything that sends mail (throttle:5,1 or a named limiter).

Webhooks

Endpoints called by outside services cannot carry a CSRF token. Exclude the route from request-forgery protection and authenticate the caller instead:

Modules/Testimonials/routes/front.php

use Illuminate\Foundation\Http\Middleware\PreventRequestForgery;

Route::post('webhooks/review-service', ReviewWebhookController::class)
    ->withoutMiddleware([PreventRequestForgery::class])
    ->middleware('throttle:60,1')
    ->name('webhooks.review-service');

In the controller, verify the provider's signature (an HMAC of the raw body with a shared secret, compared with hash_equals()) before reading anything else, and make the handler safe to receive the same event twice. Payment gateways do not need their own route: TruPayments' payments/webhook/{gateway} calls your gateway, which verifies the signature.

Output

Print with {{ }}. Use {!! !!} only for HTML you produced or cleaned yourself.
sanitize_html() only strips tags; it keeps attributes such as onclick and href="javascript:...". It is not a defence against cross-site scripting.
For short rich text typed by administrators, follow the top bar's example: App\Support\TopbarHtml::clean() keeps a handful of tags and TopbarHtml::href() accepts only safe link schemes.
Values inside style attributes and inline scripts need their own validation (a colour regex, @json() for data). Escaping alone is not enough there.

Page-builder content

Saved pages are compiled with Blade::render() every time they are shown. That is what makes shortcodes work, and it means stored content is executable template code.

Never write user data into page content raw. If your code bakes data into a page (as data-bound sections do), escape it and neutralise Blade syntax: the core baker breaks up {{ and @php with a zero-width space.
Treat shortcode attributes as untrusted. Editors (and the AI assistant) set them. The editor and the AI sanitizer limit attributes to your traits, but anyone with page access can edit HTML. Validate attributes again in your component: cast numbers, check values against the allowed options, cap limits.
Do not let a shortcode leak private data. A block placed on a public page renders for every visitor. Check the signed-in user inside the component for anything personal, and keep that page out of the response cache (CacheProfile::keepOutOfCache()).
Bound attributes are restricted.data-bind-attr refuses href, src, style, class, id, on* and srcdoc. Keep that list if you extend binding.

Uploads

Prefer the media library (HasMedia, addMediaFromRequest()) with mimes/mimetypes and max rules on the request.
The legacy fileUpload() helper keeps the client's file name, so a second upload with the same name replaces the first, on a public disk. Generate your own names for anything users upload.
Store private files (invoices, attachments) on a non-public disk and stream them through a controller that checks access, as the ticket attachments do.

Secrets

Database settings and .env values are stored in plain text. The settings password field only masks typing in the browser.
For keys you must store in the database, encrypt them with Crypt::encryptString() as the AI assistant's secret store does, and never send them back to the browser.
Never log request bodies from payment or webhook endpoints without removing card data and tokens.
Restrict credential screens to an administrator permission (manage settings or your own).

Outbound requests

Set timeouts on every HTTP call (Http::timeout(10)).
If a URL comes from a user or a package, do not fetch it blindly: allow only https, block private and loopback addresses, cap redirects and size. The template importer's RemoteAssetFetcher is the model to follow.
Tests fail on any real HTTP call, which keeps your test suite honest about what it fetches.

Distribution

A plugin ZIP is code. The Plugin Manager validates the archive and never executes it during upload, but activating it runs your provider. Sign or checksum your releases and tell customers where to get them.
Website-template packages (.trucms.zip) are the opposite: data only. If your plugin contributes to them, never put Blade, PHP or dynamic shortcode attributes in packaged content; the importer rejects packages that contain them.
Do not call home, collect analytics or load third-party scripts without the site owner opting in.

Demo installations

On demo sites (APP_DEMO=true) the demo accounts may not save anything. The guard recognises write routes by name (admin.*.store, .update, .destroy, .delete…), so name your routes conventionally and they are covered automatically.