- What does netbull/security-bundle do?
- It is a Symfony bundle that extends the native Security component with reusable configuration and helper services for authentication and access control. It wires user entities, user providers, and firewall configuration so security settings live in one place instead of being duplicated. It is built on Symfony's DI container, the Security component, and Doctrine ORM, and appears scoped to NetBull's own e-commerce lineage rather than general-purpose reuse.
- Is netbull/security-bundle a Laravel package or a Symfony bundle?
- It is a Symfony bundle, not a Laravel package, despite being installable through Composer. Laravel's Auth, Gate, and Passport abstractions do not map onto Symfony's security firewall, user providers, and authenticators, so there is no realistic integration path in a Laravel application. If your application is Laravel, this package is a no-go.
- How do I install and register netbull/security-bundle?
- Run composer require netbull/security-bundle, then register the bundle in config/bundles.php and add its configuration under config/packages. Before committing, compare the package's composer.json constraints for PHP, Symfony, and Doctrine against your runtime. Confirm that the bundle's service aliases and required entity shapes match your application's existing user model.
- What license does netbull/security-bundle use, and can I use it in a SaaS product?
- The package is licensed under AGPL-3.0, which includes the network-use clause in section 13. Any hosted or SaaS deployment where users interact over a network likely triggers an obligation to offer those users the corresponding source. For most commercial products this is a legal blocker unless the maintainer offers a commercial or dual license, so get legal sign-off before adopting it.
- Does netbull/security-bundle require Doctrine ORM?
- Yes. The bundle targets Doctrine ORM and assumes particular user entity shapes, password hashing strategies, and firewall layouts. Deviating from those assumptions causes friction, and you may need to adapt your schema or fork the bundle. It is a poor fit if you persist users outside Doctrine.
- Which Symfony and PHP versions does netbull/security-bundle support?
- There is no published compatibility matrix in the available documentation. The repository's composer.json is the source of truth, and a release dated 2025-11-21 suggests recent Symfony versions are targeted. Verify the exact PHP, Symfony, and Doctrine constraints against your runtime before planning an upgrade path.
- Is netbull/security-bundle actively maintained, and what is the bus factor?
- There is a single maintainer, 1 GitHub star, 0 dependents, and no visible governance or security disclosure policy. The 2025-11-21 release shows the maintainer is still active, but one person's activity is not a support commitment. Assume you would be the only external consumer and would own the maintenance burden.
- Is netbull/security-bundle safe to use in production for authentication?
- Be cautious. An authentication and authorization bundle sits on the most sensitive path in an application, and a package with near-zero adoption has not received the adversarial review a widely used security library gets. There is no evidence of a CVE or security advisory process, and the AGPL license further complicates commercial deployment. A scratch-app spike is fine, but production adoption should be gated on a security review.
- How does netbull/security-bundle compare to Symfony's native Security component and Maker recipes?
- The bundle mainly centralizes security configuration and provides helper services around authentication and access control. Symfony's native Security component plus standard Maker recipes already covers user providers, firewalls, and authenticators for most applications. Unless you specifically need the bundle's opinionated wiring, the native approach is lower risk and better supported.
- How should I test netbull/security-bundle before adopting it?
- Install it in a scratch Symfony application and exercise registration, login, password reset, and user management end to end. Measure how much custom configuration and schema adaptation is required before committing to anything. Also check the repository for CI status and test coverage, since there is no downstream usage or reference implementation to learn from.