How to use Claude to close a Laravel admin gate
A Claude subagent found an unconditional Laravel admin gate; the operator confirmed it, added role tests, shipped the repair, and requested a second audit.
homie-bridge.com
Original prompt
Shared by the source author. See source notes for context.
Use the security-auditor subagent to write a security report to docs/audit/security-audit.md.
Reach people exploring AI agents
See placements →Evidence at a glance
Sourced account- Source author
- Homie Bridge LLC
- Original account
- Read the source ↗
- Published
- Source link checked
- Reported result
- The unconditional admin-panel gate became role-restricted, tests passed, and a follow-up audit cited the repaired code after the same-day release.
- Human involvement
- The operator independently confirmed the critical line, chose the fix, checked administrator access, and controlled the production release.
A linked account supports attribution. It does not mean we independently reproduced its result.
Report an issue with this case
Open correction emailOpens your email app with the case link included. Nothing is sent automatically.
How the agent did it
- A Claude subagent read application code and wrote a severity-ranked report without editing the service.
- The operator inspected User.php, confirmed the unconditional admin entry, and wrote denied-user and allowed-admin cases.
- The role-gated fix passed its checks, shipped that day, and was examined by a second audit.
Homie Bridge’s operator created a Claude Code subagent to audit an existing production Laravel service. Its instruction was to read code and write a report rather than change the application. Findings included severity, file locations, possible consequences, and uncertainty.
The auditor flagged an admin-panel entry method that unconditionally returned true. The operator opened the exact line in User.php and confirmed it: any logged-in user could enter the panel, despite a separate tenant check already restricting a privileged role. That human check was essential because another service’s audit had previously overstated a credentials finding.
The fix followed a separate implementation path. The operator first wrote cases for an ordinary user being denied and an administrator being allowed, watched them fail, then added the role gate. Missing HTML sanitization on other pages was repaired too. After the checks passed, the update shipped that day.
A second audit cited the repaired code and marked the critical finding resolved. The account demonstrates a complete find, confirm, repair, and recheck loop. Its caveat is explicit: agent findings remain candidates until checked against real code or a reproduction, and changing roles must preserve the operator’s own legitimate access.
Prompt
Original prompt
Source: Company blog · Homie Bridge LLC
Frequently asked questions
Could the auditor edit application code?
Its instructions limited it to reading code and writing an audit report.
How was the critical finding confirmed?
The operator opened the exact User.php line and found the unconditional return.
What checked the repaired access rule?
Denied-user and allowed-admin cases, followed by a second audit.
More details
About this account
A Claude subagent read application code and wrote a severity-ranked report without editing the service. The operator inspected User.php, confirmed the unconditional admin entry, and wrote denied-user and allowed-admin cases.
Primary page read through HTTP after web fetch failed. Original prompt excerpt. Corporate publisher is the verified source author; the page does not name an individual. Agent findings require human confirmation. Original prompt excerpt.
Credit: Homie Bridge LLC — Company blog
Source published
Added to Agents In Use
Source checked
Tools and topics
Claude Code · Laravel · role tests
authorization · read-only audit · human confirmation
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.