I made a Symfony bundle for masking sensitive data
I recently released a small open-source Symfony bundle called MaskedBundle . The reason for building it was quite simple: logs are useful, but sometimes they can contain values that should not be there. I wanted something I could reuse in Symfony projects to mask sensitive values before they reach logs or other diagnostic output. Basic usage Installation: composer require alkinbg/masked-bundle…
A new open-source Symfony bundle named MaskedBundle has been recently released by developer Alkinbg. The primary purpose behind its creation was to address the issue of logs containing sensitive information that shouldn't be visible. This reusable solution aims to mask sensitive values before they are logged or displayed in diagnostic output. To get started with the bundle, you can install it using Composer by running the command: composer require alkinbg/masked-bundle.
For example, you can use the MaskedBundle in your Symfony project like this:
```php
use Masked\Bundle\SensitiveDataMasker;
final class PaymentService {
public function __construct (private readonly SensitiveDataMasker $masker ) {}
public function example (): string {
return $this->masker->mask('Card: 4111111111111111');
}
}
```
This will result in the output: Card: ████████████████. Currently, the automatic detection mainly focuses on payment card numbers, but the developer deliberately avoids trying to automatically detect all possible tokens, passwords, or secrets due to the numerous formats and potential for false positives. Instead, values that the application is aware of can be explicitly passed for masking:
```php
$token = 'secret-access-token';
$masked = $sensitiveDataMasker->mask('Authentication failed for token ' . $token, ['$token']);
```
The result will be: Authentication failed for token ███████████████████. Both masking approaches can be used together. There is also a StructuredDataMasker for masking arrays:
```php
$masked = $structuredDataMasker->mask([
'customer' => [
'card' => '4111111111111111',
],
]);
```
Additionally, the bundle offers optional Monolog integration, allowing messages and context to be masked before being written to the log. The developer kept this integration optional, as the masking services can also be used independently. The author emphasizes the importance of ensuring that this code handles sensitive data carefully, without allowing unusual input to produce partially checked results.
The bundle has certain limits for large arrays and explicit-value searches. If a detection budget is exceeded, the masking operation prefers to fail safely (fail closed). Although this adds some complexity internally, the developer believes it is the safer behavior for this kind of library.
MaskedBundle currently requires PHP 8.4.1 or higher and Symfony 8.1 or higher. It is licensed under the MIT license: https://github.com/alkinbg/masked-bundle and https://packagist.org/packages/alkinbg/masked-bundle. If you are using Symfony and have any feedback, the developer would be happy to hear it.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
