Security: SESSION_ENCRYPT=false in .env.example is insecure default

[Snider]

Description

The .env.example file sets SESSION_ENCRYPT=false as the default value. While this is fine for local development, it poses a security risk if developers copy this file to production without changing this setting.

File: .env.example (line 30)

SESSION_ENCRYPT=false

Impact

Unencrypted session data could expose sensitive user information if:

• The session storage is compromised
• Session data is logged or cached inappropriately
• A developer forgets to enable encryption in production

Recommendation

Either:

1. Change the default to true in .env.example
2. Add a prominent comment warning developers to enable this in production
3. Add validation in AppServiceProvider that fails loudly if SESSION_ENCRYPT=false in production

Example validation:

public function boot(): void
{
    if ($this->app->environment('production') && !config('session.encrypt')) {
        throw new RuntimeException('SESSION_ENCRYPT must be true in production');
    }
}

References

• Laravel Session Configuration: https://laravel.com/docs/session
• docs/security.md already recommends SESSION_ENCRYPT=true for production