Tootfinder

🔧 Root cause: the guard only checked that the token was not empty. The fix adds an is_string() check to both user() and validate(), so arrays and other non-string values are rejected before any database query runs
🎯 Affected: apps with a guard using 'driver' => 'token' in config/auth.php. #Sanctum and