Do you have sufficient rate limiting on your app? Are your authentication routes covered? What about your API? Can a hacker brute-force your 2FA prompt?
Rate limiting is important for a number of reasons, so make sure you have it configured!
https://securinglaravel.com/security-tip-dont-forget-rate-limiting/
#Laravel