title: Laravel mass assignment security policy
body: <p>The <code>fill</code> method of <code>Illuminate\Database\Eloquent\Model</code> is used for mass assignment, and it is called by the model constructor, which in turn is called by the <code>create</code> method.<br>
  Why doesn't it throw any exception if one or more <em>"guarded"</em> attributes are found inside the input array? Instead, it simply ignores them and keeps setting the "fillable" ones. An exception is only thrown when the model is "totally guarded" (i.e. no attribute is fillable).<p>
  Let's say that even a single guarded attribute is found where it shouldn't be: isn't that suspicious enough to be at least reported to the administrators?<br>
  For now, if I want to audit such a situation and likely <em>cancel the operation</em>, I have to check the input by myself just before the mass assignment: how is this supposed to make sense?</p>