- Can I encrypt only specific files (e.g., controllers) or does Laravel Source Encryptor require full project encryption?
- The package uses an all-or-nothing approach for encryption by default, meaning you must encrypt the entire project directory. However, you can exclude specific directories (like `vendor/`, `storage/`, or `public/`) via configuration to avoid encrypting non-critical files. Partial file encryption isn’t supported.
- Where are encryption keys stored, and how do I rotate them in production?
- Keys are stored in Laravel’s configuration (typically `config/laravel-source-encryptor.php`) or environment variables. For production, use Laravel migrations to update keys securely. The package supports key rotation without re-encrypting the entire codebase, but you’ll need to redeploy with the new key.
- Does Laravel Source Encryptor work with Laravel Mix, Vite, or Inertia for frontend assets?
- No, the package is designed for server-side PHP/Blade files only. Frontend assets (CSS, JS, compiled files) should **never** be encrypted, as they’re served directly to browsers. Exclude `resources/`, `public/`, and compiled output directories from encryption to avoid breaking builds.
- Will this break Xdebug or OPcache in development?
- Yes, encrypted files cannot be debugged with Xdebug or optimized by OPcache. Use the `debug_encrypt` mode to exclude `app/` and `routes/` directories during development. For OPcache, set `opcache.enable=0` for encrypted files or test with `opcache.validate_timestamps=1`.
- What happens if decryption fails at runtime (e.g., missing key or corrupted file)?
- The package throws a `DecryptionFailedException` with a 500 error by default. You can customize this behavior via the `onDecryptionFailure` event to show a user-friendly error page or log the failure. There’s no graceful fallback for corrupted files—always back up encrypted files.
- Is Laravel Source Encryptor compatible with Laravel 10, or do I need to stick with older versions?
- The package supports Laravel 8+ and is regularly updated for compatibility. Always pin the Laravel version in your `composer.json` (e.g., `^10.0`) and test thoroughly. Check the [GitHub releases](https://github.com/dev-reymark/laravel-source-encryptor/releases) for version-specific notes.
- How does encryption affect CI/CD pipelines (e.g., GitHub Actions, Docker)?
- Encrypted files must be decrypted **before** runtime, which requires the key to be available in your CI environment. Store keys in encrypted secrets (e.g., GitHub Secrets) and decrypt them during build/deploy. Docker builds may need a multi-stage approach to avoid exposing keys in final images.
- Are there alternatives to Laravel Source Encryptor for securing Laravel code?
- Yes, alternatives include **PHP Encoder** (commercial, standalone), **SourceGuardian** (commercial, PHP-focused), or **Laravel’s built-in `app/Providers/AppServiceProvider`** for runtime license checks. However, these often lack Laravel-specific integration or Blade template support. Evaluate trade-offs like cost, debugging ease, and asset compatibility.
- Can I encrypt database migrations or third-party libraries (e.g., Laravel packages) with this package?
- No, migrations and third-party libraries should **never** be encrypted. The package explicitly excludes `database/` and `vendor/` directories by default. Encrypting these would break Laravel’s autoloader and migration system. Manually wrap custom logic in encrypted files if needed.
- What’s the performance impact of decrypting files at runtime? Does it slow down Laravel?
- Decryption adds minimal overhead (~5–10ms per request for small projects), but latency scales with file size and complexity. Benchmark your encrypted routes in staging. Exclude heavy files (e.g., large service classes) and optimize OPcache settings for encrypted files if supported.