Weave Code
Sentinel Laravel Package
laravel/sentinel
Laravel Sentinel adds a lightweight, configurable guard layer to your Laravel app. Simple to install and expressive to use, it helps you monitor and protect key parts of your project, integrating cleanly with Laravel's config and service container without extra boilerplate.
Laravel Sentinel adds lightweight security monitoring to your Laravel application, giving you visibility into authentication activity and potential threats. It hooks into framework events to surface suspicious logins, repeated failures, and security-relevant actions—without requiring extra infrastructure.
- Event-driven tracking of logins, failures, and lockouts
- Audit logging with configurable storage
- Alerting hooks for suspicious activity
- Artisan commands to review and prune records
- Zero-config setup with publishable config
Frequently asked questions about Sentinel
- What does laravel/sentinel actually do?
- The supplied evidence does not confirm the auth-platform description. The only behavior described in the changelog is Docker container networking when a container is accessed from a local machine, and the four published PRs cover CI typos, Laravel 13 support, and that Docker fix. It is plausible that laravel/sentinel is local container or DevContainer provisioning for Laravel rather than an authentication library, so confirm scope by reading composer.json, src/, and the README directly.
- Is laravel/sentinel an official Laravel authentication package?
- It is published under the laravel/ vendor namespace, and the listed maintainers, @crynobone and @JoshSalway, are credible in the Laravel ecosystem. However, the supplied sources do not show an official support statement, a published security policy, or a CVE-response commitment, which are expected for an officially supported auth component. Treat official status as unconfirmed until you verify it on the repository.
- Which Laravel and PHP versions does laravel/sentinel support?
- The changelog ties support to Laravel 13 and PHP 8.2 or later, and there is no evidence of backward compatibility with Laravel 10, 11, or 12. You must read the illuminate/* Composer constraint to see whether Laravel 13 is a floor, a ceiling, or the only supported target. For an older Laravel service, adopting this package would force a framework upgrade first.
- How do I install and configure laravel/sentinel?
- A standard Composer install would be composer require laravel/sentinel, but the supplied sources contain no installation or configuration reference. Do not assume a sentinel:install command, a publishable config file, or auth:sentinel middleware exist, because those claims are unverified. Check package auto-discovery, the service provider, and any config publish step in source before wiring it into an application.
- Is laravel/sentinel the same as cartalyst/sentinel?
- They are different packages. cartalyst/sentinel is the long-standing third-party Sentinel authentication and authorization library, and the similar name is a likely source of confusion in search results and internal discussions. Confirm which package your team means, and verify namespace, repository, and API before copying any cartalyst/sentinel guidance into a laravel/sentinel evaluation.
- Does laravel/sentinel support roles, permissions, and RBAC?
- RBAC with roles and permissions is claimed in the companion PM and TPM write-ups, but the supplied release history contains no feature commit and no configuration reference. The evidence set is four PRs, so role and permission behavior cannot be verified from the provided material. Review src/ and the database migrations directly, and confirm whether it introduces a parallel identity store rather than integrating with your existing users table.
- Does laravel/sentinel support MFA, magic links, social login, or JWT?
- Those capabilities are asserted in the companion write-ups but are not verified by the supplied sources, and several claims, notably social login and JWT issuance, are internally contradicted by the same documents' compatibility tables. Nothing in the changelog describes MFA, magic links, social auth, or token issuance. Treat every one of these as unproven until you find the corresponding code and documentation.
- Is laravel/sentinel a good alternative to Laravel Fortify, Breeze, Sanctum, or Passport?
- Not as a default choice. Fortify, Breeze, Sanctum, and Passport are first-party, documented, and have thousands of dependents, while laravel/sentinel shows 39 stars and zero known dependents. Authentication is the highest blast-radius code in an application, so any adoption needs a specific justification for why the established first-party options are insufficient.
- Is laravel/sentinel production-ready, and does it have a security policy?
- Semver says 1.1.0, but the release history is three releases and four PRs, one of which is a YAML typo, so treat it as pre-stable and the 1.x API as uncommitted. The supplied sources contain no README, configuration reference, migration guide, or API documentation, and no security disclosure policy is shown. For an auth component, the absence of a documented CVE-response commitment is a serious production concern.
- How should I evaluate laravel/sentinel before adopting it?
- Run a time-boxed technical spike of three to five days instead of authorizing a migration. Read composer.json, src/, and the README to build a one-page feature inventory from source, confirm whether the package is auth or developer-environment tooling, and verify the actual Laravel version constraint. Set a hard exit gate requiring documentation, a security policy, and a clear answer on interoperation with Sanctum or Passport before any commitment.
Weaver
How can I help you explore Laravel packages today?