Great question in the comments for: https://securinglaravel.com/p/security-tip-disable-dev-tools-on
"Would you recommend moving "laravel/tinker" to dev?"
No, since it's only a command line tool, but you do need to consider your audit trail. Building custom Artisan commands instead would be easier to test and review.
#Laravel #PHP
@outofcontrol @valorin me too.
Though I switched to using tinkerwell’s ssh capability now.
@outofcontrol @emd I use Tinker all the time. Granted, it's on small single dev projects, but still.
I've tried to like Tinkerbell, but it's never worked well for me on Win+WSL.
@outofcontrol I offered them help to make Tinkerwell work with WSL2 some years ago. But they never came back to me. Not sure if it’s working by now. I switched to macOS in the meantime.