- Is jgxvx/cilician-bundle a Laravel package or a Symfony bundle?
- The assessment says the published artifact is a Symfony bundle with a Bundle class and DependencyInjection definitions, despite generic listing text that mentions Laravel-style service providers and publishable config. Laravel's container does not boot Symfony bundles, so treat Laravel support as unverified. Read the Codeberg source before planning any integration.
- How do I install jgxvx/cilician-bundle with Composer?
- There is no evidence of a Packagist release, tagged versions, or semver, so a normal composer require is not confirmed. You would likely need a VCS repositories entry pointing at Codeberg and then hand-wire the non-bundle classes. Confirm the licence first, because none is stated.
- Does Cilician Bundle work with Laravel's service container?
- Probably not. The assessment describes Symfony DI wiring, YAML configuration, and autowiring; Laravel does not boot Symfony bundles, so the package's main value-add disappears in a Laravel app. Reimplementing the small HTTP client natively is likely cheaper than forking and stripping the Symfony layer.
- What HIBP API endpoints does the Cilician client cover?
- The assessment lists breachedAccount, pasteAccount, breaches, breach/{name}, dataClasses, and latestBreach. That is a thin HTTP facade over HIBP v3 REST semantics, not an algorithm or storage layer. Verify current endpoint coverage in source, since HIBP's API has changed over time.
- Does it support the HIBP API key header and required User-Agent?
- The assessment says the package is a reference implementation of request semantics, including the hibp-api-key header and mandatory User-Agent. Audit the source to confirm both are actually sent on every request. These are hard requirements for HIBP v3, not optional niceties.
- How does Cilician Bundle handle 404 and 429 responses from HIBP?
- The intended semantics are that 404 means not-breached rather than an error, and 429 should trigger backoff. Those behaviors are described in the assessment as part of the package's value. Check the source and tests, because no test suite or fixtures are visible.
- Can I use the free Pwned Passwords range API without a paid HIBP key?
- The assessment asks whether the package supports the Pwned Passwords range API with k-anonymity and a 5-character SHA-1 prefix, which needs no paid key. That support is not confirmed in the provided context. If it is missing, that endpoint is trivial enough to implement directly.
- Is there test coverage or a mocking strategy for Cilician Bundle?
- No test suite, CI, recorded fixtures, or mocking strategy is visible. That matters for an auth-path dependency because you need deterministic tests for 404, 429, and malformed responses. Treat the absence of tests as a reason to reimplement rather than depend.
- What are the security and PII risks of using this package for breach lookups?
- Breach-lookup queries include the user's email address, and the package reads an HIBP key from framework configuration. Audit whether it logs request URLs, email addresses, or key material before putting it in an authentication path. Unknown maintainer, non-GitHub hosting, and no advisory channel increase supply-chain risk.
- Should I depend on Cilician Bundle or reimplement the HIBP client in Laravel?
- The assessment recommends reimplementing natively; the client logic is roughly 100 to 200 lines. Option (a) VCS install with hand-wiring and option (b) forking to strip Symfony DI both import maintenance and provenance risk. For a Laravel auth path, a small audited client is the defensible choice.