Livewire public property exposure: accidental sensitive data leakage?

Livewire public property exposure

In Livewire, any property declared as public on a component class is automatically serialized and sent to the browser. If a developer inadvertently marks a sensitive value—such as a user ID, API token, or an Eloquent model—as public, that data becomes available to any client that can trigger the component.

There is no built‑in guard to prevent the serialization of non‑scalar types, and the framework’s documentation only recommends using protected or private visibility and exposing data through getters. Recent discussions suggest a configurable strict‑mode that would reject public properties containing complex objects, but no stable release currently implements it.

Given that route middleware does not affect this serialization, the question remains how to reliably detect and avoid accidental public exposure before deployment.

• What detection mechanisms can be employed to flag public properties that hold sensitive or non‑scalar data?
• Does Livewire offer a strict‑mode configuration that rejects or warns about such properties?
• How can developers enforce visibility rules programmatically across multiple components?