Laravel Password Exposed Validation Rule Laravel Package

Product Decisions This Supports

• Adding breached-password prevention to registration, password reset, and account settings as a low-effort security baseline.
• Roadmap and platform decisions: adopt a Laravel validation rule that supports Laravel 13/PHP 8.5 while retaining Laravel 8/PHP 7.4 compatibility, reducing upgrade blockers for mixed-version portfolios.
• Build vs buy: adopt and maintain a small, focused validation package rather than building custom breach-lookup handling, string coercion logic, regression tests, and Laravel integration.
• Use cases: consumer sign-up, B2B SaaS onboarding, admin portals, password-change flows, and policy enforcement inside Laravel validation.
• v6.1.0 supports standardizing validation composition: pair this rule with Laravel string/type rules, avoid conversion warnings, and reduce unnecessary breach lookups for non-string inputs while still checking objects with a string representation.
• Migration decision: no obvious major-version migration is introduced, but the non-string behavior change should be tested anywhere mixed input types may reach the rule.

When to Consider This Package

• Consider it when the application is Laravel-based, already uses Laravel validation, and needs a simple breached-password check in authentication flows.
• Good fit when you want maintained Laravel/PHP compatibility across Laravel 8–13 and PHP 7.4–8.5, regression coverage, and documented composition with Laravel validation.
• Good fit when you want Laravel-native handling of non-string values rather than package-level coercion, warnings, or avoidable breach lookups.
• Look elsewhere if you need offline/air-gapped breach data, a local password corpus, advanced strength scoring, password reuse/history checks, or enterprise policy orchestration beyond a validation rule.
• Look elsewhere if external breach lookups are prohibited by policy, latency or privacy constraints require local-only checks, or the application is not Laravel/PHP.
• Re-evaluate existing integrations that relied on non-string values being coerced; add explicit string/type validation before this rule and confirm expected failure behavior.

How to Pitch It (Stakeholders)

• Executives: v6.1.0 is a low-risk security and compatibility update. It enables breached-password checks with minimal engineering effort, supports both current and older Laravel/PHP stacks, and reduces friction for upcoming framework upgrades.
• Engineering: adopt it as a composable Laravel validation rule. v6.1.0 adds Laravel 13/PHP 8.5 support while keeping the Laravel 8/PHP 7.4 floor, avoids coercing non-string inputs and unnecessary breach lookups, still checks Stringable objects, and includes regression coverage plus composition guidance. Validate types explicitly and test flows that may have previously passed non-string values.