Notes on Laravel

MCP servers are great for AI chat, but sometimes you need the underlying API too.

I removed my is_admin column two weeks ago.

Every page in Growth Method was loading 6KB of invisible vector data per campaign.

How I removed spatie/laravel-permission from Growth Method, replaced it with a single Gate and a team_user pivot, and shipped the change in three safe phases.

A compromised npm account turned Axios into a RAT dropper for 3.5 hours.

How to wrap any REST API — like Google Search Console — as AI tools in Laravel, without needing an MCP server.

Laravel Boost shipped a new laravel-best-practices skill that checks your code against 100+ rules.

How we built one generic Livewire chat component that works with any AI agent — streaming responses, MCP tool support, and per-team security boundaries — using the Laravel AI SDK.

The Flux editor defaults to a 500px max height, creating nested scrollbars on full-page forms.

How we replaced Algolia with pgvector semantic search in our Laravel app — saving money, removing a dependency, and getting better results.

I spent two years with an is_admin flag in my users table before asking whether I needed it at all.

How the Laravel Scheduler works, the three automated tasks we run at Growth Method, whether a per-minute cron job is wasteful, and the production safeguards every app should use.

Two days after removing Laravel Pulse, I reinstalled it to build an admin dashboard for Growth Method.

I had Laravel Pulse running in production for over a year alongside Sentry.

What happened when I ran Laravel Shift's Test Generator on a Laravel 13 codebase with Pest 4.

I migrated a production Laravel app from MySQL to PostgreSQL on Laravel Forge.

Laravel Horizon was overkill for my app.

How I used Laravel Shift and Laravel Boost (via Claude Code) together to upgrade a production app to Laravel 13 — and why using both gave me the best of both worlds.

I audited my Laravel app against the conventions that Laravel Shift checks for and fixed everything that mattered -- return types, environment checks, stale code.

How I replaced a hand-rolled Alpine.js notification system across 17 files with Flux's built-in toast component.

Laravel launched a community-powered Skills Directory at skills.laravel.cloud — an open collection of reusable AI agent skills for Laravel and PHP.

AI agents can delete your database, wipe your files, and destroy months of work in seconds.

WWTD — What Would Taylor Do?

Real examples of applying YAGNI (You Aren't Gonna Need It) while building a Laravel SaaS app with an AI coding agent.

Why every Laravel test failed with "Unknown database 'testing'", what the testing database actually does, and how LazilyRefreshDatabase keeps your real data safe.

Foreign key cascadeOnDelete looks like the perfect cleanup solution — until you use soft deletes.

Agentic engineering is a new discipline — not vibe coding, not traditional development.

The biggest announcements from Laracon EU 2026 in Amsterdam — Laravel 13, passkeys, the AI SDK going stable, NativePHP going free, and more — filtered through what actually matters if you're building with Laravel but don't write code.

Streaming AI responses in Livewire caused a flash of raw markdown (**bold text**) before the HTML rendered.

Deleting a team in a multi-tenant Laravel app broke transactions, orphaned pivot rows, and wiped user data across teams.

A user clicked Create Account and nothing happened.

A real security audit of a Laravel app found IDOR vulnerabilities in Livewire components, XSS through strip_tags(), mass assignment with $guarded = [], and predictable share tokens.

I migrated my production Laravel app from MySQL to PostgreSQL.

Migrating from PrismPHP to Laravel's official AI SDK broke two agents silently.

I literally cannot write a line of PHP from memory.

Switching from Froala to TipTap broke every image in our app.

One question to Claude Code — "is there anything obvious that could be having a negative impact on performance?"

A performance audit found three JavaScript libraries shipping on every page that nothing in the app actually used.

Laravel Blaze makes your Blade components render up to 97% faster with zero code changes.

Laravel's conventions, curated ecosystem, and readable syntax make it uniquely suited for non-traditional developers building real products with AI.

Five things I learned about AI by building a real Laravel app with Claude Code.

I received a scary-sounding security vulnerability report about my Laravel app.

Three types of visual shift that make your Laravel app feel janky, and the patterns to fix each one.

A collection of small but meaningful UX improvements for Laravel apps — external link indicators, preventing layout shift, and more.

Laravel's updateOrCreate silently creates duplicates when passed a null ID.

A single 500 error on my idea edit page turned out to be three separate bugs stacked on top of each other.

A plain-language explanation of Laravel migrations for non-developers.

A practical guide to fixing the most common errors you'll hit when pulling a Laravel project locally for the first time — S3, Algolia, Livewire, and more.

You don't need to memorise git commands to ship Laravel code.

Flux UI's checkbox component silently does nothing in traditional HTML forms.