- What is Cilician and what is it used for?
- Cilician is a lightweight Laravel/PHP package that adds Cilician capabilities to a Laravel application through a small, predictable public API. It follows convention over configuration and integrates with Laravel's service container, service provider auto-discovery, and an optional facade. The package description positions it as a framework-native integration layer, and it has no persistence, queue workers, or middleware of its own.
- How do I install Cilician in a Laravel application?
- Install it with Composer using composer require jgxvx/cilician. Laravel's package auto-discovery should register the service provider and facade without manual edits. The listing does not confirm a Packagist release, so you may need to add the Codeberg repository as a VCS source pinned to a commit.
- Is Cilician available on Packagist or do I need a VCS repository?
- The listing is hosted on Codeberg and does not confirm a Packagist release, tagged versions, or dependents. If no Packagist entry exists you would add a VCS repository entry in composer.json and pin to a commit SHA. That works for a vendored dependency but means you are adopting source code rather than consuming a supported release.
- Which PHP and Laravel versions does Cilician support?
- The description says the package is compatible with modern PHP versions and integrates with Laravel, but it does not state specific PHP or Laravel version constraints. Check the composer.json require block and tagged releases before adopting it. If no tags exist, test against your target Laravel and PHP versions before pinning a commit.
- Does Cilician include a service provider and facade with Laravel auto-discovery?
- The advertised Laravel surface includes an auto-discovered service provider, an optional facade, and publishable configuration. Those features are described in the package overview, but the technical assessment notes they are unverified from the listing alone. Confirm the provider and facade classes exist in the source before relying on auto-discovery.
- How do I publish and configure the Cilician configuration file?
- Publish the configuration with the standard vendor:publish command for the package's config tag, then set project-specific values such as timeouts, retries, base URL, and API key source. The assessment flags that it is unconfirmed whether the config is genuinely environment-aware. Review the published file and keep credentials in .env rather than committing them.
- Is Cilician a Have I Been Pwned client, and does it support Pwned Passwords k-anonymity?
- Engineering assessments read the package as a thin wrapper over the Have I Been Pwned REST API rather than a general-purpose toolkit. If so, Pwned Passwords range queries use k-anonymity, so only a five-character SHA-1 prefix leaves your infrastructure. That privacy property comes from the HIBP protocol, not the package, and is roughly 150 lines to implement yourself.
- How should I test code that uses Cilician?
- The package advertises a fluent, test-friendly API and PHPUnit/Pest coverage, but the assessment could not confirm that the test suite mocks the HTTP layer. In your own tests, bind a fake implementation behind an internal interface such as BreachLookup rather than calling the client directly. That keeps tests fast and avoids hitting HIBP rate limits.
- Is Cilician safe to use in production, especially with API keys and rate limits?
- Because the package is security-adjacent and handles email addresses and an API key, review how requests, URLs, and keys are logged before production use. The assessment lists 429 and Retry-After handling, jittered backoff, API key header injection, User-Agent requirements, Add-Padding, and response caching as unverified. Wrap the client behind your own interface so you can add retries, caching, and redaction.
- Is Cilician actively maintained, and what are the alternatives?
- There is no observable audit history, security disclosure process, or dependent ecosystem, and it appears to be a single-maintainer package. For HIBP lookups you can call the REST API directly with a small HTTP client, or use a maintained alternative, and keep the integration behind an internal contract. If you adopt Cilician, plan to maintain your fork and monitor HIBP API changes.