I know this is several years too late but figured I would add in, locking down your laravel project once in production does not take too much effort. If you utilize @csrf and form validation as stated above that will cover your "doors" there. On top of using something like fail2ban on the server and pointing everything to the public folder within your laravel application will reduce Brute forcing and deter a lot of the common PHP web scans that come in daily from malicious IP addresses. On my servers I typically see certain IP addresses scanning for common php, phpmyadmin, and mysql.php files that do not turn up any 200 http responses. In addition, having the final product/compiled version of the site in it's own directory and implementing all your 3rd party creds within the .env (which is required to link your laravel project to a db) file, make it hard for malicious actors to find system files and credentials.
In addition, the authentication out of the box does all the hashing for you "secure Bcrypt and Argon2 hashing". In addition to hashing, it has been noted that the Hash::make function creates and uses a 22-length random string as a salt to generate the password, from question Where are laravel password salts stored?. Which references a Wordpress article on laravel hashing and salting Laravel Hash::make() explained. Hopefully that helps anyone reading this.
If you are deploying a laravel site to a VPS or whatever, then I would highly recommend daily or at least every two days coming the access logs and deny ##IP address##; anything that is trying to access URIs they are not suppose to access (since you built it you will know what they should and shouldn't be accessing), and implementing fail2ban to greatly reduce ssh brute force. If anyone needs more info or has more questions about maintaining a laravel website in the wild/linux server, I am always here. Coming from someone in the Cyber Sec industry , that freelances web development