- Does matt9mg/doctrine-encryption-bundle work with Laravel?
- No. It is a Symfony bundle that registers through Symfony's Kernel, services.yaml, and compiler passes, hooking into Doctrine ORM events and DBAL custom types. Laravel has no equivalent bundle or Kernel surface for it to attach to, so it cannot be installed as a normal Composer dependency in a Laravel app. Treat it as a design reference only, not an integration.
- Can I install this Symfony bundle in a Laravel application with Composer?
- You can add it to composer.json, but nothing will wire it up. The package expects Symfony bundle auto-registration and container configuration, and Laravel's service providers do not replicate that. Even with laravel-doctrine/orm installed, the bundle's Symfony wiring does not travel with it, so the encryption subscriber and types would never be registered.
- What is the Laravel alternative for encrypting sensitive database columns?
- Use Laravel's built-in encrypted, encrypted:array, and encrypted:collection Eloquent casts, available since Laravel 9. They are backed by the Crypt facade, which uses authenticated AES-256-CBC with an HMAC and supports key rotation through APP_PREVIOUS_KEYS. This is framework-maintained and already audited, unlike a single-maintainer Symfony component.
- How do I encrypt a GDPR-sensitive field in a Laravel Eloquent model?
- Cast the attribute to encrypted in your model's casts array, and Laravel will encrypt on write and decrypt on read transparently. For structured data, use encrypted:array or encrypted:collection so serialization happens before encryption. No extra package is required, and normal model usage stays unchanged.
- Does Laravel's encrypted cast support key rotation?
- Yes. Laravel supports decrypting values encrypted with previous keys via APP_PREVIOUS_KEYS, letting you rotate APP_KEY without losing access to existing rows. You still need a plan to re-encrypt old rows under the new key over time, but the read path handles the transition. That is a documented, first-class capability rather than an open question.
- Can I port this bundle's approach to Laravel instead of using it directly?
- Yes, and that is the realistic path. The reusable ideas are narrow: a subscriber that encrypts on flush and decrypts on hydration, plus a custom type that transforms values on read and write. In Laravel you would implement that as an Eloquent cast using CastsAttributes, or as a Doctrine custom type plus a service provider if you genuinely run Doctrine. Either route is a few hundred lines of your own code plus a crypto review.
- Is this package maintained and safe for regulated GDPR data?
- The evaluation treats it as unmaintained and unreviewed, with one star, no dependents, and a very low composite health score. For a component whose only job is protecting regulated data, that is disqualifying on its own, because field-level encryption bugs such as IV reuse or unauthenticated ciphertext fail silently. There is no evidence of external consumption or downstream projects to shake out defects.
- Does this bundle support searchable encryption or blind indexes?
- The assessment notes it does not appear to provide a blind index, so searchable or sortable encrypted fields are not covered. Randomized encryption prevents equality searches and ordering, while deterministic encryption enables them but leaks patterns. Decide which fields truly need search before choosing a design, because that requirement drives the architecture more than the package choice does.
- What Doctrine DBAL and Symfony versions does this bundle support?
- Compatibility is unverified across the board, with no confirmed Symfony version floor and no confirmed DBAL major version. Doctrine-in-Laravel setups pin DBAL majors aggressively, so a stale custom type against DBAL 3 or 4 is a breakage waiting for the next composer update. Ask the maintainer for explicit version constraints before spending any engineering time.
- Should I fork this bundle or write my own Eloquent cast?
- Write your own cast or use Laravel's built-in encrypted casts rather than forking. Forking inherits a single-maintainer Symfony codebase you cannot load and a security review you would have to repeat anyway. If you only need field-level encryption for GDPR, the framework primitive already covers it, and any custom work should focus on your data classification and key rotation plan.