Vault Bundle

⭐ Found this useful? Give it a star on GitHub so more developers can find it.

Symfony bundle for a password and secrets vault: logins, secure notes, credit cards, contacts, identity documents, folders, sharing, trash, read-only events, and a built-in password generator.

This bundle is FrankenPHP worker mode friendly.

Features

• Item types: login, secure note, credit card, contact, ID card, driver's license, passport, document
• Folders with share and trash; item soft-delete with restore/purge
• Tags — label items, filter and search by tag
• VaultGrant for users and teams (read / write / admin) + share UI
• VaultTeamMembershipResolverInterface for team-based grants
• Browser extension — REST API + Chrome/Firefox autofill (optional)
• Runtime config — optional DB-backed settings with admin UI
• Key rotation — nowo:vault:reencrypt command and demo walkthrough
• Events: list query/result, access check, read-only resolve, extension auth
• Server-side libsodium payload encryption; CSRF on manage POST actions
• Dark manage UI + password generator (modal + inline)
• Document attachments (encrypted in payload)

Installation

composer require nowo-tech/vault-bundle

php -r 'echo base64_encode(random_bytes(32)), PHP_EOL;'

# config/packages/nowo_vault.yaml
nowo_vault:
    user_class: App\Entity\User
    encryption_key: '%env(VAULT_ENCRYPTION_KEY)%'

See Installation.

Demo

make -C demo/symfony8 up
# Demo started at: http://localhost:8023  →  /tools/vault (auto-login)

Documentation

• GitHub Actions CI requirements
• Installation
• Configuration
• Browser extension
• Usage
• Contributing
• Code of Conduct
• Changelog
• Upgrading
• Release process
• Security
• Encryption key rotation
• Engram
• Spec-driven development
• GitHub Spec Kit

Additional documentation

• Access control & read-only events
• Demo with FrankenPHP

Tests and coverage

make test              # PHPUnit
make test-ts           # Vitest
make test-coverage     # PHP coverage report
make release-check     # Full pre-release QA

The test-coverage-100 / release-check gate targets 100% line coverage on the measured subset of src/ (see phpunit.xml.dist). Controllers, repositories, forms, and Doctrine listeners are excluded from that metric; they are covered by E2E and integration tests instead. New services and domain logic under src/Service/, src/Security/, etc. must remain fully covered to pass release checks.

Run make test-coverage and make test-ts for current PHP and TS coverage percentages.

License

MIT — see LICENSE.