# SEC-01 — CSRF Protection — Semua Form

**Category:** security  
**Status:** ok  
**Elapsed:** 0s  
**Timestamp:** 2026-05-19T21:50:00

**Target Files:**
- `resources/views/frontend/contact/index.blade.php`
- `resources/views/frontend/careers/show.blade.php`
- `resources/views/admin/**/*.blade.php`

---

## Output

✓ OK: Semua 29 forms telah memiliki `@csrf`.

### Frontend (2 forms)
| File | Line | CSRF | Method |
|------|------|------|--------|
| `frontend/contact/index.blade.php` | 81 | `@csrf` | POST |
| `frontend/careers/show.blade.php` | 57 | `@csrf` | POST |

### Admin (27 forms)
Semua form create/edit pakai `@csrf` + `@method('PUT')` conditional. Semua form delete pakai `@csrf @method('DELETE')`.

**Create/Edit forms (13):**
- `admin/auth/login.blade.php:34` — `@csrf`
- `admin/settings/edit.blade.php:8` — `@csrf @method('PUT')`
- `admin/users/form.blade.php:8` — `@csrf @if($user) @method('PUT') @endif`
- `admin/testimonials/form.blade.php:8` — sama
- `admin/stats/form.blade.php:8` — sama
- `admin/services/form.blade.php:8` — sama
- `admin/products/edit.blade.php:8` — sama
- `admin/product-categories/form.blade.php:8` — sama
- `admin/menus/form.blade.php:8` — sama
- `admin/faqs/form.blade.php:8` — sama
- `admin/careers/form.blade.php:8` — sama
- `admin/brands/form.blade.php:8` — sama
- `admin/blog/posts/form.blade.php:6` — sama
- `admin/blog/categories/form.blade.php:6` — sama

**Upload forms (4):**
- `admin/product-images/index.blade.php:11` — `@csrf`
- `admin/product-highlights/index.blade.php:11` — `@csrf`
- `admin/product-specs/index.blade.php:14` — `@csrf`
- `admin/media/index.blade.php:11` — `@csrf`

**Delete forms (10):**
Semua pakai `@csrf @method('DELETE')` inline:
- `admin/products/index.blade.php:57`
- `admin/product-categories/index.blade.php:31`
- `admin/brands/index.blade.php:31`
- `admin/product-images/index.blade.php:43`
- `admin/product-highlights/index.blade.php:36`
- `admin/product-specs/index.blade.php:40`
- `admin/contact-messages/index.blade.php:23`
- `admin/careers/index.blade.php:27`
- `admin/career-apps/index.blade.php:30` — `@csrf @method('PUT')` (status update)

**Verdict:** CRITICAL — No issues found. All forms protected against CSRF.