> ## Content Index
> Fetch the complete content index at: https://securinglaravel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Security Tip: Disable Dev & Test Commands in Production
- URL: https://securinglaravel.com/security-tip-disable-dev-and-test/
- Published: 2021-10-31T21:00:48.000Z
- Updated: 2024-09-23T12:00:05.000Z
- Description: [Tip #6] Because sometimes being paranoid is a good thing.
- Author: Stephen Rees-Carter
- Tags: Security Tips, Artisan, Workflow, Debug, Dev Tools, Environment

⚠️

****Important:** This is an old article, and there is a new `Prohibitable` trait in Laravel 11 which solves this problem in a more elegant way. Head over to [Security Tip #83](https://securinglaravel.com/security-tip-prohibiting-destructive-commands-on-production/) to learn more about it.

If you’re like me, you’ll have some Artisan commands in your projects that run development and/or testing tasks. These commands manipulate data in some way and are **definitely not safe** to run on production.

This is what I do to stop dev & test Artisan commands being accidently run:

1. **Block execution of the command** within the `handle()` method by checking the environment. I usually throw an error message and return an invalid response.

```
public function handle()
{
    if (! app()->isLocal()) {
        $this->error('This command can only be used in dev!');
        return Command::INVALID;
    }

    // ...
}
```

1. **Hide the command** from `php artisan` by returning `true` from a `isHidden()` method on the command. This just keeps Artisan a bit cleaner.

```
public function isHidden()
{
    return ! app()->isLocal();
}
```

1. There is no step three. 😎

Depending on the environments you need to target, there are a few different conditionals you can use:

```
// By name
app()->environment('local')

// Multiple by name
app()->environment('local', 'testing')

// 'local'
app()->isLocal()

// 'testing'
app()->runningUnitTests()

// 'production'
app()->isProduction()
```

Finally, putting it all together into a command so you can see all the pieces in action:

```
<?php
namespace App\Console\Commands;

use Illuminate\Console\Command;

class DevHelper extends Command
{
    /** @var string */
    protected $signature = 'dev:helper';

    /** @var string */
    protected $description = 'Perform an important dev task.';

    public function isHidden()
    {
        return ! app()->isLocal();
    }

    public function handle()
    {
        if ($this->isHidden()) {
            $this->error('This command can only be used in dev!');
            return Command::INVALID;
        }

        // ...

        return Command::SUCCESS;
    }
}
```

---

**Found this security tip helpful?* Don't forget to* [*subscribe*](https://securinglaravel.com/#/portal/signup) *to receive new* [*Security Tips*](https://securinglaravel.com/tag/tips/) *each week, and upgrade to a* [*premium subscription*](https://securinglaravel.com/#/portal/signup) *to receive monthly* [*In Depth articles*](https://securinglaravel.com/tag/in-depth/)*, or toss a coin in the* [*tip jar*](https://securinglaravel.com/#/portal/support)*.*

*Reach out if you're looking for a* [*Laravel Security Audit and Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com) *or a budget-friendly* [*Security Review*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com)*, and find me on the various socials through* [*Pinkary*](https://pinkary.com/@valorin?ref=securinglaravel.com)*. Finally, don't forget to check out* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive security course.*