Critical-risk tools in Laravel Forge
47 of the 272 tools in Laravel Forge are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
delete-archived-serverDestructiveDelete an archived server (DELETE /orgs/{organization}/servers/archives/{server}).
-
delete-background-processDestructiveDelete a background process.
-
delete-backup-configurationDestructiveDelete a backup configuration.
-
delete-backup-instanceDestructiveDelete a backup instance.
-
delete-certificateDestructiveDelete an SSL certificate.
-
delete-composer-credentialDestructiveDelete a Composer credential (DELETE .../composer/credentials/{repository}).
-
delete-database-schemaDestructiveDelete a database schema.
-
delete-database-userDestructiveDelete a database user.
-
delete-deploy-keyDestructiveDelete the deploy key for a site.
-
delete-domainDestructiveDelete a domain.
-
delete-firewall-ruleDestructiveDelete a firewall rule.
-
delete-heartbeatDestructiveDelete a heartbeat.
-
delete-horizon-integrationDestructiveDisable Laravel Horizon on a site.
-
delete-laravel-maintenance-integrationDestructiveDisable Laravel maintenance mode on a site.
-
delete-laravel-scheduler-integrationDestructiveDisable the Laravel scheduler integration on a site.
-
delete-monitorDestructiveDelete a server monitor.
-
delete-nginx-templateDestructiveDelete an nginx template.
-
delete-npm-credentialDestructiveDelete an npm credential (DELETE .../npm/credentials/{registry}).
-
delete-octane-integrationDestructiveDisable Laravel Octane on a site.
-
delete-php-opcacheDestructiveRemove PHP OPcache configuration (DELETE /orgs/{organization}/servers/{server}/php/opcache).
-
delete-php-versionDestructiveDelete an installed PHP version (DELETE /orgs/{organization}/servers/{server}/php/versions/{phpVersion}).
-
delete-pulse-integrationDestructiveDisable Laravel Pulse on a site.
-
delete-push-to-deployDestructiveDisable push-to-deploy for a site.
-
delete-recipeDestructiveDelete a recipe.
-
delete-redirect-ruleDestructiveDelete a redirect rule.
-
delete-reverb-integrationDestructiveDisable Laravel Reverb on a site.
-
delete-roleDestructiveDelete an organization role.
-
delete-security-ruleDestructiveDelete a security rule.
-
delete-serverDestructiveDelete a server (DELETE /orgs/{organization}/servers/{server}).
-
delete-server-logDestructiveClear a server log by key.
-
delete-server-scheduled-jobDestructiveDelete a server scheduled job.
-
delete-siteDestructiveDelete a site (DELETE /orgs/{organization}/servers/{server}/sites/{site}).
-
delete-site-application-logDestructiveClear the application log for a site.
-
delete-site-commandDestructiveDelete a site command record.
-
delete-site-nginx-access-logDestructiveClear the nginx access log for a site.
-
delete-site-nginx-error-logDestructiveClear the nginx error log for a site.
-
delete-site-scheduled-jobDestructiveDelete a site scheduled job.
-
delete-ssh-keyDestructiveDelete an SSH key from a server.
-
delete-storage-providerDestructiveDelete a storage provider.
-
delete-teamDestructiveDelete a team.
-
delete-team-inviteDestructiveDelete a team invitation.
-
delete-team-memberDestructiveRemove a member from a team.
-
delete-team-recipes-shareDestructiveRemove a recipe share from a team.
-
delete-team-server-credentials-shareDestructiveRemove a server credential share from a team.
-
delete-team-servers-shareDestructiveRemove a server share from a team.
-
delete-webhookDestructiveDelete a webhook.
-
reset-deployment-statusDestructiveReset deployment status and disable quick deploy for a site.
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.