Weave Code
Exment Laravel Package
exceedone/exment
Exment is an open-source, self-hosted, Laravel-based no-code/low-code platform for building custom business apps, databases, and workflows. It provides Excel-like tables, forms, permissions, dashboards, and automation, enabling teams to manage data and processes without coding.
Exment is open source software for managing information assets on the Web. / Exmentは、情報資産をWeb上で管理するための、オープンソースソフトウェアです。
Frequently asked questions about Exment
- What is Exment and how does it relate to Laravel?
- Exment is an open-source, self-hosted no-code/low-code platform built on Laravel for creating custom business database applications without coding. It ships as a Composer package (exceedone/exment) but behaves as a full Laravel application, owning routing, authentication, migrations, file storage, the admin UI, and the queue/scheduler. You get table and column designers, custom forms, dashboards, approval workflows, role-based permissions, CSV import/export, and a REST API.
- How do I install Exment in a Laravel project?
- Installation is composer require exceedone/exment followed by the package's install command, which gets a working demo environment running quickly. The technical effort is not in the install itself but in the surrounding decisions: identity unification, avoiding route-prefix and published-asset collisions, and deciding who owns the database schema. Treat it as a deployable application rather than a drop-in library you compose into an existing app.
- Which Laravel and PHP versions does Exment support?
- Exment targets Laravel 9 through 11 on PHP 8.1 or later, with MySQL or PostgreSQL and the standard Laravel queue and scheduler. Because it is coupled to Laravel major versions, plan your upgrade cadence around Laravel releases. Teams already familiar with Eloquent, Blade, Artisan, and policies will ramp up quickly because the idioms are the same.
- What license does Exment use, and can I use it in a commercial SaaS product?
- Exment is released under GPL-3.0, which is copyleft, so embedding it in-process inside a distributed or SaaS product requires legal review before any engineering starts. There is also a commercial/paid edition with advanced workflow, SSO, and support that should be priced into the business case early. The license question is driven almost entirely by whether the deployment is an internal tool or a customer-facing product.
- Can I add Exment to my existing Laravel application as a package?
- You can technically install it alongside an existing app, but Exment inverts the usual integration direction: you adapt your system to Exment, not the other way around. It fits poorly as a component inside a mature domain model that already owns authentication, users, and schema. The recommended model is to run Exment as a separate deployable with its own database and integrate through its REST API or a plugin, never by writing directly against its internal tables.
- How does Exment handle users, authentication, roles, and permissions?
- Exment carries its own users, roles, policies, and permission layer, so it becomes a second source of identity if you already have authentication elsewhere. A key design question is whether you can SSO into Exment rather than duplicating user accounts across systems. Role-based access control covers the admin surface, custom views, and record-level permissions, but it must stay in sync with your core product's authorization model.
- Does Exment provide a REST API for integration?
- Yes, Exment exposes a REST API and also supports outbound events, which is the correct integration surface for a bolt-on data-management console next to an existing Laravel product. Use the API or a plugin rather than querying its internal tables directly, since the schema is owned by the package and changes across versions. This API-first containment model keeps upgrade risk isolated to the Exment deployment.
- What security risks should I consider before deploying Exment?
- The 6.2.15 patch release closed eight vulnerabilities in one drop, including two directory traversals, three XSS issues, one SQL injection, one improper authentication, and one improper access restriction. That breadth shows the attack surface is the entire admin area: custom views, CSV import/export, file handling, and the permission layer, so any instance below 6.2.15 reachable by untrusted or low-privilege authenticated users should be assumed exploitable. These are backported patches rather than a redesign, so assume further findings will appear. Put the instance behind SSO, a WAF, and an IP allowlist rather than exposing it directly to the internet, and keep a short patching SLA including out-of-band emergency updates.
- How can I extend Exment with custom functionality?
- Extension surfaces include custom column classes, Composer-based plugins, event hooks, and the REST API, alongside built-in workflow and approval processes. They are real but constrained, and custom columns plus plugins are the most fragile surface on every upgrade. For anything non-trivial, integrate through the API or a plugin rather than patching internals, and keep customizations small enough to re-validate after each release.
- What should I plan for Exment maintenance and upgrades?
- Exment is coupled to Laravel major versions, so you need to assign clear ownership of Laravel upgrades and a security-patch SLA, including emergency patching for out-of-band releases. The ecosystem signal is modest, with a few hundred GitHub stars and no dependents, which is normal for an application-shaped package but means limited third-party patterns and little advance warning of zero-days. Define an exit plan in case the maintenance cadence stalls, and decide up front whether the paid edition's vulnerability notification and support change the calculus.
Weaver
How can I help you explore Laravel packages today?