How do you secure Laravel integrations?

API keys and secrets are stored in encrypted environment variables or a secret manager (AWS Secrets Manager, HashiCorp Vault), never in the database or repository. Webhooks are validated through HMAC signatures or shared secrets. Outbound requests use HTTPS only with certificate pinning where the integration supports it. Sensitive payload data (PII, financial information) is logged at debug level only and redacted from production logs. PCI scope is minimised by tokenising card data through the gateway and never touching raw card numbers in Laravel.