nowo-tech/vault-bundle

Symfony bundle for a password and secrets vault: logins, notes, cards, contacts, documents, folders, sharing, trash, and password generator

v1.1.2 2026-07-13 11:00 UTC

Requires

• php: >=8.2 <8.6
• ext-sodium: *
• doctrine/doctrine-bundle: ^2.10 || ^3.0
• doctrine/orm: ^2.15 || ^3.0
• symfony/config: ^7.4 || ^8.0
• symfony/dependency-injection: ^7.4 || ^8.0
• symfony/form: ^7.4 || ^8.0
• symfony/framework-bundle: ^7.4 || ^8.0
• symfony/http-kernel: ^7.4 || ^8.0
• symfony/routing: ^7.4 || ^8.0
• symfony/security-bundle: ^7.4 || ^8.0
• symfony/translation: ^7.4 || ^8.0
• symfony/twig-bundle: ^7.4 || ^8.0
• symfony/validator: ^7.4 || ^8.0
• symfony/yaml: ^7.4 || ^8.0

Requires (Dev)

• doctrine/mongodb-odm: ^2.6
• doctrine/mongodb-odm-bundle: ^5.0
• friendsofphp/php-cs-fixer: ^3.0
• nowo-tech/doctrine-encrypt-bundle: ^2.2
• phpstan/extension-installer: ^1.0
• phpstan/phpstan: ^2.0
• phpstan/phpstan-phpunit: ^2.0
• phpstan/phpstan-symfony: ^2.0
• phpunit/phpunit: ^10.0
• rector/rector: ^2.0
• symfony/asset: ^7.4 || ^8.0
• symfony/browser-kit: ^7.4 || ^8.0
• symfony/dom-crawler: ^7.4 || ^8.0
• symfony/var-exporter: ^6.4 || ^7.0 || ^8.0

Suggests

• doctrine/mongodb-odm-bundle: Planned future platform support when nowo_vault.database.platform is mongodb (not implemented in 1.x).
• nowo-tech/doctrine-encrypt-bundle: Encrypts vault_settings.encryption_key at rest when storing the vault master key in the database.
• nowo-tech/password-strength-bundle: Strength policy, live feedback, and generator for login password fields.
• nowo-tech/password-toggle-bundle: Show/hide toggle for login password fields (used with password-strength-bundle).
• nowo-tech/tag-input-bundle: Tagify-powered multi-tag input for item labels.

MIT

• Héctor Franco Aceituno
• Nowo.tech

• symfony
• security
• encryption
• secrets
• symfony-bundle
• vault
• password-manager

Published on Packagist.org on 2026-07-13 11:01 UTC

README

⭐ Found this useful? Give it a star on GitHub so more developers can find it.

Symfony bundle for a password and secrets vault: logins, secure notes, credit cards, contacts, identity documents, folders, sharing, trash, read-only events, and a built-in password generator.

FrankenPHP worker mode: Supported — demo uses FrankenPHP on Symfony 8 (Demo with FrankenPHP).

Features

• Item types: login, secure note, credit card, contact, ID card, driver's license, passport, document
• Folders with share and trash; item soft-delete with restore/purge
• Tags — label items, filter and search by tag
• VaultGrant for users and teams (read / write / admin) + share UI
• VaultTeamMembershipResolverInterface for team-based grants
• Browser extension — REST API + Chrome/Firefox autofill (optional)
• Runtime config — optional DB-backed settings with admin UI
• Key rotation — nowo:vault:reencrypt command and demo walkthrough
• Events: list query/result, access check, read-only resolve, extension auth
• Server-side libsodium payload encryption; CSRF on manage POST actions
• Dark manage UI + password generator (modal + inline)
• Document attachments (encrypted in payload)

Installation

composer require nowo-tech/vault-bundle

php -r 'echo base64_encode(random_bytes(32)), PHP_EOL;'

# config/packages/nowo_vault.yaml
nowo_vault:
    user_class: App\Entity\User
    encryption_key: '%env(VAULT_ENCRYPTION_KEY)%'

See Installation.

Demo

make -C demo/symfony8 up
# Demo started at: http://localhost:8023  →  /tools/vault (auto-login)

Documentation

• Installation
• Configuration
• Browser extension
• Usage
• Contributing
• Changelog
• Upgrading
• Release process
• Security
• Encryption key rotation
• Engram
• Spec-driven development
• GitHub Spec Kit

Additional documentation

• Access control & read-only events
• Demo with FrankenPHP

Tests and coverage

make test              # PHPUnit
make test-ts           # Vitest
make test-coverage     # PHP coverage report
make release-check     # Full pre-release QA

The test-coverage-100 / release-check gate targets 100% line coverage on the measured subset of src/ (see phpunit.xml.dist). Controllers, repositories, forms, and Doctrine listeners are excluded from that metric; they are covered by E2E and integration tests instead. New services and domain logic under src/Service/, src/Security/, etc. must remain fully covered to pass release checks.

Run make test-coverage and make test-ts for current PHP and TS coverage percentages.

License

MIT — see LICENSE.