Ignition Security Recommendations

Ignition has the ability to run executable solutions. These solutions can make your life better by running migrations when you forgot to run them, generating an APP_KEY if you set none, fixing variable names in your code, ...

These runnable solutions are only available when Laravel is in debug mode.

We highly recommend to never turn on debug mode on a non-local environment. If you do so then you risk exposing sensitive information and potentially allow outsiders to execute solutions.

Should you have activated debug mode on a non-local environment, then Ignition will display a warning.

Disable executing solutions

Should you, for some reason, do need to set debug mode to true on a non-local environment, then we highly recommend turning off Ignition's ability to execute solutions. You can do this by setting the ignition.enable_runnable_solutions config key to false.

If you're using Ignition v2.6.1 or higher, then it's not possible anymore to run solutions in a non-local environment.

Reporting security issues

Please don't use the public issue tracker, but report all security issues to [email protected]