- Is SpecShaper EncryptBundle compatible with Laravel?
- Not natively. It is a Symfony bundle built around Doctrine attributes, Symfony dependency injection, and event subscribers, while Laravel uses Eloquent, service providers, and custom casts. There is no Laravel service provider, config publishing, or Eloquent cast, so treat it as a reference implementation rather than a drop-in dependency.
- Can I install specshaper/encrypt-bundle in a Laravel project with Composer?
- Composer may install the package, but installation does not create Laravel integration. You would still need to wire the cipher into Eloquent casts, configuration, and key management yourself. For production, prefer a Laravel-native encrypted cast or a thin package around a vetted crypto library.
- Does this package encrypt Eloquent model fields automatically?
- No. Encryption and decryption are transparent only for Doctrine entities marked with the Encrypted attribute. Eloquent models do not use Doctrine hydration, so you must implement a custom cast or accessor and mutator. Do not assume the bundle will protect Eloquent attributes without additional code.
- Which PHP and Laravel versions does SpecShaper EncryptBundle support?
- The package is Symfony-oriented and the provided assessment does not confirm official Laravel version support. Verify PHP 8.1+ compatibility, Symfony component conflicts, and whether Laravel 10, 11, or 12 can coexist in Composer. Run a dependency audit before adding it to a Laravel application.
- What encryption algorithm does SpecShaper EncryptBundle use?
- The provided information does not specify the algorithm, authenticated mode, IV handling, or test vectors. Encryption is security-critical, so review the source and confirm whether it uses an authenticated mode such as AES-GCM. Do not deploy until algorithm and failure-mode behavior are verified.
- How are encryption keys configured and rotated in Laravel?
- The bundle configures keys through Symfony configuration, not Laravel config. Key rotation, envelope encryption, and KMS or Vault integration are not confirmed in the assessment. For Laravel, design key management separately and document rotation and incident runbooks.
- Can I query or search encrypted fields after using this bundle?
- Encrypted values cannot be queried normally because ciphertext does not match plaintext lookups. If searchable fields are required, you need blind indexes or deterministic tokens designed alongside the encryption scheme. Doctrine attributes do not solve Eloquent query patterns.
- Is it safe to fork this bundle for a Laravel production app?
- Forking is possible but makes your team responsible for security-critical cipher code, PHP upgrades, and crypto review. The package shows weak ecosystem signals, including low stars and zero dependents, and the release metadata should be validated. Fork only with test vectors, source review, and a clear maintenance owner.
- How does the bundle handle nullable, JSON, and large text fields?
- The assessment does not confirm behavior for nullable, JSON, or large text columns. Ciphertext expansion, database column types, serialization, and queue behavior all need testing. Prototype these cases in staging before migrating any production data.
- What should Laravel teams use instead of SpecShaper EncryptBundle?
- Prefer Laravel's built-in encrypted casts or a custom cast around a vetted crypto library with envelope encryption and KMS support. Add blind indexes where lookup is required and plan batch backfills for existing data. Use this bundle only as a design reference or isolated cipher fork if you accept the ownership burden.