Entenda como funciona

É sempre bom reforçar que segurança tem muito a ver com entender como as coisas funcionam.

Dica: Não é XSS.

<?php
// Arquivo: routes/web.php

use App\Http\Controllers\PostController;
use Illuminate\Support\Facades\Route;


Route::get('/posts/{id}', [PostController::class, 'get']);
Route::put('/posts/{id}', [PostController::class, 'put']);
<?php
// Arquivo: app/Http/Requests/UpdatePostRequest.php

namespace App\Http\Requests;

use App\Models\Post;
use Illuminate\Foundation\Http\FormRequest;

class UpdatePostRequest extends FormRequest
{
    /**
     * Determine if the user is authorized to make this request.
     */
    public function authorize(): bool
    {
        $postExists = Post::where('id', $this->id)
            ->where('author_id', $this->user()->id)
            ->exists();

        return $postExists;
    }

    /**
     * Get the validation rules that apply to the request.
     */
    public function rules(): array
    {
        return [
            'title' => 'required|string|max:64',
            'content' => 'required|string|max:65535',
        ];
    }
}
<?php
// Arquivo: app/Http/Controllers/PostController.php

namespace App\Http\Controllers;

use App\Http\Requests\UpdatePostRequest;
use App\Models\Post;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
use Illuminate\Http\Response;

class PostController extends Controller
{
    public function get(
        Request $request,
        int $postId
    ): JsonResponse {
        $post = Post::where('author_id', $request->user()->id)
            ->findOrFail($postId);

        return response()->json($post);
    }

    public function put(
        UpdatePostRequest $request,
        int $postId
    ): Response {
        $post = Post::findOrFail($postId);
        $post->update([
            'title' => $request->title,
            'content' => $request->content,
        ]);

        return response()->noContent();
    }
}