- Can I use insitaction/field-encrypt-bundle in a Laravel application?
- Not natively. It is a Symfony bundle built around Doctrine DBAL types and a Symfony DI extension, while Laravel uses Eloquent and service providers. You would need to extract or decouple the crypto primitive and wrap it in a custom Eloquent cast rather than expect a drop-in integration.
- Does this package support Laravel 10 or Laravel 11?
- No official Laravel support is documented for this package. Its releases track Symfony compatibility, and v3.0.5 adds Symfony 7, which requires PHP 8.2 or newer. Verify your PHP floor before assuming a Laravel 10 application on PHP 8.1 is supported.
- How do I install and configure insitaction/field-encrypt-bundle?
- For Symfony, install it with Composer using insitaction/field-encrypt-bundle, enable the bundle, and configure encryption keys and cipher settings through the bundle configuration. Then mark sensitive Doctrine entity properties with the provided attributes or annotations. There is no Laravel service provider or config publishing path in the package.
- How do I mark a Doctrine field for encryption?
- Use the package attribute or annotation on the sensitive Doctrine property. The bundle then handles encryption on persist and decryption on hydrate so application logic can keep working with plaintext values. You still need to review column types, indexes, and schema changes for encrypted storage.
- Will field-level encryption break my existing database schema or indexes?
- Expect schema changes, especially for sensitive columns that were sized for plaintext. Ciphertext plus base64 encoding and nonce or tag overhead commonly grows payloads 1.5 to 3 times, so VARCHAR 255 may need TEXT or VARCHAR 512. Encrypted columns also cannot be indexed normally, so equality lookups require a blind index or deterministic scheme.
- Is this package production-ready for sensitive PII or PCI data?
- Treat it as high risk until you complete your own review. The package has zero dependents, no CVE history, no documented third-party crypto review, and a low composite score, so external validation is thin. Key management, rotation, authenticated cipher mode, and ciphertext versioning remain your responsibility. Maintenance for Symfony compatibility is not the same as maintenance for cryptographic correctness.
- Does it support key rotation and ciphertext versioning?
- The provided context documents configurable keys and cipher settings but does not clearly document rotation or ciphertext versioning. Safe rotation requires old and new keys to coexist and ciphertext to carry a version identifier. Plan this as Custom key-management work and test decrypting old data after a key change.
- How should I test encrypted fields in Laravel if I wrap the crypto primitive?
- Test the custom Eloquent cast rather than the Symfony bundle wiring. Assert plaintext round-trips, stored ciphertext differs from plaintext, wrong keys fail, null and empty values behave correctly, and old ciphertext still decrypts after rotation. Use a real test database and avoid asserting exact ciphertext values.
- What are Laravel alternatives to this Symfony bundle?
- Laravel already provides encrypted casts and the Encrypter service backed by APP_KEY for simple column encryption. For searchable or deterministic requirements, use a blind index or a dedicated PHP library such as CipherSweet rather than porting a Doctrine-coupled bundle. The Symfony bundle remains a better fit for Symfony Doctrine entities than for Eloquent models.
- Is insitaction/field-encrypt-bundle actively maintained?
- There is a v3.0.4 to v3.0.5 release history, and v3.0.5 adds Symfony 7 compatibility, so it is not a single-release package. However, it has zero dependents, no CVE history, no external crypto validation, and a low composite score. Framework-compatibility releases do not prove ongoing cryptographic maintenance.