Lanjit 0.2.0 has not received an independent security audit. It provides signed HTTP-only session cookies, CSRF validation, scrypt password hashing, AES-256-GCM encryption, request size limits, rate limiting, authorization gates, and baseline security headers.
Important limitations
Sessions and rate limits are in-memory, default CORS allows *, CSP and HSTS are not built in, and trusted-proxy handling is not yet available. Never deploy with an empty APP_KEY. Report vulnerabilities privately through GitHub Security Advisories.
Examples
APP_DEBUG=false
SESSION_SECURE_COOKIE=truenode artisan key:generate