Laravel Password Exposed Validation Rule Laravel Package

Product Decisions This Supports

• Compromised-password protection as a product requirement: Supports adding a Laravel validation rule that blocks known-breached passwords during registration, password reset, password change, and account-recovery flows.
• Security roadmap and compliance posture: Helps teams adopt a pragmatic password-security control—checking for compromised credentials—without building a custom breach-lookup integration.
• Build vs. buy: Favors package adoption over in-house breach-check plumbing, especially where the team wants a maintained rule that composes with Laravel’s validator rather than a bespoke service.
• Upgrade planning: v6.1.0 supports Laravel 13 and PHP 8.5 while retaining PHP 7.4/Laravel 8 support, so a single package release can cover mixed-version portfolios and reduce upgrade friction.
• Validation behavior decisions: v6.1.0 defers non-string values to Laravel string/type validation instead of emitting conversion warnings or performing unnecessary breach lookups. This supports cleaner validation pipelines and clearer error ownership.
• Use cases: Consumer sign-up, B2B SaaS account creation, admin portals, password-reset flows, and any Laravel product where account takeover risk or password hygiene is a concern.

When to Consider This Package

Consider this package when:

• You need Laravel-native validation of passwords against known breaches.
• You want a composable validation rule rather than a full identity/password-policy platform.
• You need compatibility across Laravel 8 through 13 and PHP 7.4 through 8.5.
• You want objects with a string representation to continue being checked.
• You want documented guidance for composing the rule with Laravel’s string and type validation rules.
• You want regression-tested behavior rather than maintaining custom breach-lookup code.

Look elsewhere when:

• Your identity provider or IAM platform already enforces breached-password detection.
• Validation cannot make external network calls or must run fully offline.
• You need advanced policy orchestration, risk scoring, SIEM integration, or enterprise password-policy administration.
• You are not using Laravel’s validation stack.
• You need non-string inputs to fail via the breach rule itself; v6.1.0 intentionally leaves those to Laravel string/type rules, so validation ordering and rule composition matter.

How to Pitch It (Stakeholders)

For executives: This is a low-effort security control that helps prevent account takeover by rejecting known-compromised passwords. It supports password-security and compliance goals without building and maintaining a custom breach-check integration.

For engineering: v6.1.0 is a drop-in Laravel validation rule update with broad compatibility—Laravel 13/PHP 8.5 through Laravel 8/PHP 7.4. It reduces noisy conversion warnings and unnecessary breach lookups for non-string values, continues checking objects with string representations, and documents composition with Laravel validation. Teams should pair it with Laravel string/type rules for non-string inputs and rely on the added regression coverage when upgrading.