xxxxxxxxxx
// Keep your stuff updated
composer outdated
composer audit
// secure session and xsrf cookies
SESSION_SECURE_COOKIE' = true
// Require Encryption (AKA HSTS FTW)
Strict-Transport-Security
// XSS Attacks / Be intentional with your output
{{ }}, HtmlString, e()
// You need a backup plan.
Content-Security-Policy:
// don't trust third party packages
search 'SRI hash generator' and hash css and js links. 'integrity="..."'