Weave Code
Laravel Env Security Laravel Package
stechstudio/laravel-env-security
Laravel Env Security lets you encrypt sensitive values in your .env file and decrypt them automatically at runtime, keeping API keys, database credentials, and other secrets out of plaintext. Includes Artisan commands to encrypt and decrypt environment files.
Securely manage Laravel .env files for different deployment environments
Frequently asked questions about Laravel Env Security
- How do I install laravel-env-security in a Laravel app?
- Install it with Composer by running composer require stechstudio/laravel-env-security. Then publish the package config with php artisan vendor:publish and generate an encryption key. The package adds no service provider surgery or middleware, so it stays in the deployment and config toolchain.
- How do I encrypt my .env file using Artisan?
- The package provides Artisan commands to encrypt and decrypt environment files. Run the encryption command after generating a key, then commit the resulting artifact. Keep the key outside the repository, for example as a masked secret in your CI/CD pipeline.
- How does automatic decryption work at runtime?
- It decrypts the encrypted .env artifact at deploy or boot time automatically, so Laravel reads the config values without secrets sitting in plaintext in the repository. The key is supplied from outside the repository. The package lives in the deployment and config path, not in the request path.
- Which PHP and Laravel versions does stechstudio/laravel-env-security support?
- Version 3.0 adds Laravel 13.x support via a one-line compatibility PR, but the major bump likely drops older Laravel and PHP versions. Check the exact min and max constraints in the package's composer.json before installing. Version 2.4 users should pin ^2.4 and avoid floating into 3.0 unless upgrading in lockstep with a Laravel major.
- Is it safe to commit an encrypted .env file to my repository?
- It can be safe only if your organization permits encrypted secrets in version control and you keep the single env.key outside the repo. This is a governance decision, not just a library choice, and it conflicts with mandates to centralize secrets in Vault, AWS Secrets Manager, or Doppler. Confirm policy before adopting.
- What happens if the encryption key is lost or leaked?
- The single env.key is a single point of failure: losing it makes encrypted configs unrecoverable, and leaking it compromises every environment's artifact at once. The package offers no rotation, revocation, per-environment scoping, or audit trail. Treat key storage and backup as a critical operational control.
- How do I avoid stale encrypted .env files after editing .env?
- Editing .env without re-encrypting and committing the new artifact produces silent config drift, the highest-frequency failure in this model. Make re-encryption a required step in your deployment checklist or CI pipeline. The tool does not solve this process risk for you.
- How does laravel-env-security compare to Laravel's built-in env:encrypt and env:decrypt commands?
- Laravel ships native env:encrypt and env:decrypt commands, so the first question is whether you need the dependency at all. A single-maintainer package chasing each Laravel major can lag behind framework-native capability and adds a recurring compatibility-review tax. If native commands cover your need, retiring the dependency is a valid migration path.
- Does laravel-env-security work with Laravel Vapor or other managed platforms?
- It is a known poor fit for Laravel Vapor and similar managed platforms that provide their own secret stores. Check the platform's native secret management before recommending this package. It fits Laravel apps deployed via CI/CD where the pipeline can hold a masked key.
- How should I upgrade from laravel-env-security 2.4 to 3.0?
- There is no functional benefit to upgrading 2.4 on a supported framework because 3.0 adds only Laravel 13.x compatibility and no features or fixes. Move 2.4 to 3.0 only in the same change window as the Laravel major upgrade, and run a decrypt round-trip test against a 2.4-produced artifact. Pin versions exactly and confirm the cipher, key format, and artifact filename are unchanged.
Weaver
How can I help you explore Laravel packages today?