Laravel Vulnerability Disclosure

generated: '2026-07-19'
method: searched
probe: true
source: https://laravel.com/docs/13.x/contributions, https://trust.laravel.com/,
  https://github.com/laravel/boost/security/policy, https://forge.laravel.com/docs/abuse
notes: The automated security-programs probe found no security.txt and no bug-bounty page, which is
  accurate. Laravel does nonetheless publish a real vulnerability-reporting policy — in the framework
  contribution guide, in per-repository GitHub security policies, and as a Responsible Disclosure entry
  in the SafeBase trust center. Those are recorded here as the disclosure surface.
program_type: coordinated disclosure (no public bug bounty)
policy:
- url: https://laravel.com/docs/13.x/contributions#security-vulnerabilities
  kind: documentation
  statement: If you discover a security vulnerability within Laravel, please email our security team.
    All security vulnerabilities will be promptly addressed.
  note: The security team email address is published on this page but is obfuscated by Cloudflare email
    protection in the served HTML, so it is not transcribed here.
- url: https://trust.laravel.com/
  kind: trust-center
  statement: Responsible Disclosure is listed as an App Security control in the Laravel Trust Center.
- url: https://github.com/laravel/boost/security/policy
  kind: repository-security-policy
  statement: Laravel repositories carry a GitHub security policy for reporting vulnerabilities privately.
  note: Each laravel/* repository README links to its own /security/policy page.
- url: https://forge.laravel.com/docs/abuse
  kind: abuse-reporting
  statement: Laravel Forge publishes an abuse-reporting page covering abuse, security concerns and
    violations on Forge-managed servers.
advisories:
- url: https://forge.laravel.com/docs/knowledge-base/cve-2026-31431
  kind: security-advisory
  title: Copy Fail security advisory (CVE-2026-31431)
  description: Advisory for a Linux kernel privilege-escalation vulnerability affecting Laravel Forge
    servers.
  note: Demonstrates that Laravel publishes customer-facing advisories for infrastructure CVEs in the
    Forge knowledge base.
bug_bounty:
  published: false
  platforms_checked:
  - HackerOne
  - Bugcrowd
  - Intigriti
  result: none found
security_txt:
  published: false
  hosts_checked:
  - https://laravel.com/.well-known/security.txt
  - https://forge.laravel.com/.well-known/security.txt
  - https://cloud.laravel.com/.well-known/security.txt
  - https://id.laravel.com/.well-known/security.txt
  result: 404 on laravel.com, cloud.laravel.com and id.laravel.com; 302 to /sign-in on forge.laravel.com
evidence:
- source: https://laravel.com/docs/13.x/contributions
  kind: documented-policy
  matched: security vulnerability, security team, promptly addressed
- source: https://trust.laravel.com/
  kind: trust-center
  matched: responsible disclosure, application penetration testing
- source: https://forge.laravel.com/docs/knowledge-base/cve-2026-31431
  kind: advisory
  matched: CVE-2026-31431
gaps:
- No RFC 9116 security.txt on any host, so automated scanners cannot discover the reporting channel.
- No public bug bounty program and no published disclosure SLA or safe-harbour statement.
- The reporting address is only reachable by rendering an obfuscated mailto on the contributions page.