Your API test passes. The response still contains an API key.

A 200 status and the expected JSON shape do not establish that the response is safe to expose. A serializer refactor or a new settings property can introduce a sensitive field without breaking either assertion.

Explicit API Resources and model hiding rules are a good start. A response-level regression assertion checks the output after those mechanisms run.

I maintain Laravel LeakProof for this boundary. It inspects selected sensitive field names and recognizable credential patterns. It does not contact providers to validate keys.

Install and add the assertion trait

composer require --dev mykholy/laravel-leakproof:^1.1

Enter fullscreen mode

Exit fullscreen mode

Supports Laravel 12/13. The package's PHP constraint starts at 8.2; Laravel 13 requires 8.3+.…