Episode

Local and production should match even for Laravel tools

Podcast
No Compromises
Published
Apr 11, 2026
Duration seconds
795
Processing state
not_requested
Canonical source
https://share.transistor.fm/s/f02a08d9
Audio
https://media.transistor.fm/f02a08d9/f6867a84.mp3
JSON
/v1/public/podcasts/no-compromises-1309932/episodes/local-and-production-should-match-even-for-laravel-tools
Markdown
/podcast/no-compromises-1309932/local-and-production-should-match-even-for-laravel-tools.md

Actions

  • POST https://stenobird.com/v1/public/podcasts/no-compromises-1309932/episodes/local-and-production-should-match-even-for-laravel-tools/transcription-requests
    Idempotently request low-priority transcript generation for this episode.
  • GET https://stenobird.com/podcast/no-compromises-1309932/local-and-production-should-match-even-for-laravel-tools.md
    Read the agent-friendly Markdown representation of this episode resource.

Summary

Ever installed a Laravel package locally and immediately accessed it, only to wonder later whether your access controls are actually working in production? In the latest episode of the No Compromises podcast, we discuss why tools like Telescope and Horizon behave differently in local environments versus production, and why that inconsistency is a problem worth solving. We make the case that developer convenience should never come at the cost of security confidence. If your gate logic cannot be exercised locally, you cannot truly trust it is protecting your production environment. We also dig into how Aaron worked around the issue by overriding the package's service provider logic, and why Laravel has since made this easier to handle cleanly. (00:00) - Why local and production environments should match (01:42) - How Telescope's gate logic behaves differently locally (03:01) - The risk of untestable access control logic (07:53) - How Aaron overrode the service provider to fix it (10:23) - Silly bit (00:00) Why local and production environments should match (01:42) How Telescope's gate logic behaves differently locally (03:01) The risk of untestable access control logic (07:53) How Aaron overrode the service provider to fix it (10:23) Silly bit Our courses took the production hits so your app doesn't have to.