- Can I install guilhermednt/pathwell-bundle in a Laravel application?
- No. guilhermednt/pathwell-bundle is a Symfony bundle built on symfony/framework-bundle and the Symfony DI container, and it provides no Laravel service provider or Illuminate validation rule. In a Laravel codebase it is a reference implementation to port, not a Composer dependency. Do not try to boot Symfony's framework bundle inside Laravel.
- How do I install and enable the bundle in Symfony?
- Install it with Composer using composer require guilhermednt/pathwell-bundle, then enable the bundle in config/bundles.php for the environments that need it. Its services are autowirable and behavior is tuned from a single configuration file. Check the real composer.json constraints first, because the last release dates to 2022 and targets older PHP and Symfony versions.
- How do I configure the PathWell top-N threshold and topology corpus?
- The bundle exposes configuration for the PathWell topology corpus and the top-N cutoff, which controls how many of the most common keyboard-walk topology classes are rejected. Set that cutoff from measured rejection rates on your own credential corpus rather than trusting a default. Verify in the source that the corpus size, provenance, and top-N setting are actually configurable.
- Does this package support Laravel validation rules, Fortify, or Jetstream?
- There is no Laravel support at all: no service provider, no Rule object, and no Fortify, Jetstream, or Breeze integration. Laravel's validation pipeline uses a different contract from Symfony's validator constraints. You would need to extract the topology logic and reimplement it as a custom Laravel rule and password-policy config.
- Is it compatible with PHP 8.2 and Symfony 6 or 7?
- Compatibility is unverified. The package was last released on 2022-06-27 by a single maintainer and likely carries PHP 7.4 and Symfony 4-5 era constraints. Check composer.json and run the test suite against your target PHP and Symfony versions before adopting it, and expect to fork or patch for PHP 8.2+ and Symfony 6 or 7.
- Does the package include tests that reproduce published PathWell results?
- There is no evidence of parity against the published PathWell corpus or test vectors. A subtly wrong topology map would silently weaken the policy while appearing to work. Require tests that reproduce published PathWell results, and add your own parity tests before trusting the package.
- Where should the topology corpus live in production?
- Do not query a database per request in the authentication path. Load the topology set once and cache it in memory or a fast shared cache, then do the membership test locally. The evaluation flags the corpus storage location, size, and provenance as items to verify.
- What are the licensing risks of using this GPL-3.0 bundle?
- The package is GPL-3.0, which is copyleft. Internal and SaaS use is generally not distribution, but embedding it in on-prem, SDK, appliance, or white-label products can trigger source-disclosure obligations for derivative work. Get legal review before engineering investment, and consider a clean-room reimplementation of the algorithm as a mitigation.
- Is PathWell a replacement for NIST password guidance or HIBP breach checks?
- Treat PathWell as a supplement, not a replacement, for NIST SP 800-63B-aligned controls. Keep breach-list or HIBP blocking, length minimums, and no forced composition or rotation. Positioning keyboard-walk rejection as your primary password policy is a compliance and UX risk.
- Which keyboard layouts does it support, and what about international users?
- This is an open question. A US-QWERTY-only char-to-key map implies false accepts and false rejects for international users. Verify which keyboard layouts are covered and test with your actual user base; plan to extend the map if you need broader coverage.