- What does philetaylor/doctrine-encrypt do?
- It is intended as a Doctrine ORM persistence-layer extension that adds transparent field-level encryption through a custom DBAL type, so sensitive entity columns are encrypted at rest and decrypted automatically. It is not a Laravel Eloquent package, and its description explicitly says WIP DO NOT USE. The repository has no meaningful documentation or examples, so the intended behavior cannot be verified from the package alone.
- Is philetaylor/doctrine-encrypt safe for production use?
- No. The package description says WIP DO NOT USE, it has one star, zero dependents, and a single release dated 2022-01-03, so there is no evidence of production use. For a security control like encryption, an unreviewed abandoned implementation can create false assurance and compliance risk. Cipher selection, IV and nonce handling, key derivation, rotation, deterministic versus randomized mode, and migration interaction are all unverified.
- Does philetaylor/doctrine-encrypt work with Laravel Eloquent?
- No, it is built around Doctrine ORM custom DBAL types, not Eloquent. Using it in a typical Laravel app would require running Doctrine via a bridge such as laravel-doctrine/orm or limiting it to a Doctrine-based service. For Eloquent, Laravel's native encrypted cast is the first-party option for common field encryption needs.
- How do I install philetaylor/doctrine-encrypt?
- It is Composer-installable and MIT-licensed, so there is no legal blocker, but installation details are not documented in the provided excerpt. Because the package is marked WIP DO NOT USE and has no examples or issue history, you should not install it in a shared or production environment. Any evaluation should be a timeboxed spike on a throwaway branch.
- Which PHP, Laravel, and Doctrine versions does philetaylor/doctrine-encrypt support?
- Compatibility is unproven. The 2022 release predates current PHP 8.2+ and Laravel 10, 11, and 12 expectations, and Doctrine ORM 2.x versus 3.x, PHP 8 attributes versus legacy annotations, custom DBAL types, and migration tooling all need explicit verification. Assume unsupported until tested.
- Is philetaylor/doctrine-encrypt actively maintained?
- There is no evidence of active maintenance. The assessment cites a single release dated 2022-01-03, roughly three years without releases, no maintainer activity assumed, and no downstream consumers to sanity-check behavior. That makes abandonment risk realized rather than theoretical.
- What are alternatives to philetaylor/doctrine-encrypt for Laravel?
- For Eloquent, use Laravel's native encrypted cast for ordinary field-level encryption. For searchable encryption, paragonie/ciphersweet is maintained and audited; for broader coverage consider disk or database encryption such as pgcrypto or TDE, or a KMS envelope pattern. If the service genuinely runs Doctrine, compare against a maintained Doctrine encryption bundle rather than this dormant package.
- Can philetaylor/doctrine-encrypt handle key rotation and key management?
- That is unknown and must not be assumed. The package provides no documented key management, rotation, re-wrap, or re-encryption workflow, and those controls are essential for production encryption. Key ownership should be defined first, typically through AWS KMS, GCP KMS, Vault, or an envelope encryption design, before evaluating any library.
- Does philetaylor/doctrine-encrypt support searching or sorting encrypted fields?
- Plain field-level encryption generally cannot support equality search, sorting, or partial matching on ciphertext, and the package does not document any searchable-encryption capability. If queryability is required, the alternative set narrows to CipherSweet-style searchable encryption or database-native options. Confirm the requirement before considering any package.
- How should I evaluate or migrate away from philetaylor/doctrine-encrypt?
- Write down the encryption requirement first: data classes, threat model, compliance citation, and key ownership. If the package already exists in an estate, treat removal as a replacement project with a data re-encryption plan, not a version bump, and treat any existing ciphertext as needing decrypt-then-re-encrypt under a reviewed scheme. Timebox any research spike to at most two days on a throwaway branch and aim for a go/no-go note, never a production prototype.