Use when configuring Laravel-specific auth/session/CSRF/authorization plumbing - Sanctum SPA authentication, session cookie hardening, policy/gate wiring, mass-assignment guards, signed URLs, or encrypted casts. For generic web-security review (injection, secrets, auth-vs-authz on any stack) use security-review instead; this skill is for getting Laravel's own framework mechanisms configured correctly.
