---
title: "Security notes — Opening Hours for Laravel | Roundly"
description: "What the package guards for you — foreign ids, hidden meta, bound columns, size limits — and what stays your responsibility."
url: https://roundly-consulting.com/open-source/docs/opening-hours-for-laravel/security
language: en
---

[All packages](https://roundly-consulting.com/open-source.md)

[Opening Hours for Laravel](https://roundly-consulting.com/open-source/docs/opening-hours-for-laravel.md)

# Security notes

- Ids in a sync payload must belong to the calendar being written; foreign ids are rejected (unknown\_id).
- OpeningHours::exceptions($owner)->remove($id) only touches that calendar’s rules — any other id returns false.
- Labels are returned raw — escape them in your templates.
- meta is hidden from API resources by default (api.expose\_meta); php artisan about shows the cache store only as default or custom.
- Column names given to EloquentBusyPeriodProvider are allow-list validated; values are bound.
- The limits.\* keys cap definition size, busy periods read and slots returned, guarding against oversized input.
- Mass deletes of owners (Clinic::query()->delete()) fire no model events and leave their calendars behind — polymorphic owners cannot carry a foreign key.
- Availability is a read — guard bookings with your own lock or unique constraint.

## Show your open-source love

This package is free and MIT-licensed. If it saves you time, a one-off donation or a Patreon membership keeps it maintained, tested and documented.

[More ways to support, including crypto](https://roundly-consulting.com/support-us.md)

By donating, you agree to our [donation terms](https://roundly-consulting.com/donation-terms.md).

[Support our open source work (opens in a new tab)](https://donate.stripe.com/dRmeVe8FX5PF1Qd9pXcEw00) [Join us on Patreon (opens in a new tab)](https://www.patreon.com/cw/roundly)

## Want this built into your product?

We integrate our packages into custom Laravel and AI builds. Tell us what you're working on and we'll reply within 48 hours.

[Get a quote in 48 hours](https://roundly-consulting.com/contact.md) [Browse all packages](https://roundly-consulting.com/open-source/docs/opening-hours-for-laravel.md)