Download the PHP package aflorea4/laravel-source-obfuscator without Composer

Laravel Source Code Obfuscator

A comprehensive Laravel package for source code obfuscation using PHPBolt. Protect your Laravel application's source code with advanced obfuscation techniques, perfect for CI/CD pipelines and deployment workflows.

Features

• 🔒 PHPBolt Integration - Uses PHPBolt engine for professional-grade obfuscation
• ⚙️ Highly Configurable - Extensive configuration options for fine-tuned control
• 📁 Smart File Selection - Include/exclude patterns for precise file targeting
• 🔄 Automatic Backups - Create backups before obfuscation with rotation
• 🚀 CI/CD Ready - Designed for seamless integration into deployment pipelines
• 📊 Detailed Reporting - Generate comprehensive obfuscation reports
• 🎯 Multiple Commands - CLI commands for various obfuscation tasks
• ⚡ Performance Optimized - Parallel processing support for large codebases
• 🛡️ Safe Operation - Dry-run mode and validation checks

Requirements

• PHP >= 7.4
• Laravel >= 8.0 (8.x, 9.x, 10.x, 11.x, 12.x)
• PHPBolt extension (bolt.so) - Get it here

Installation

1. Install via Composer

2. Install PHPBolt Extension

PHPBolt is a free PHP extension for code obfuscation. Install the bolt.so extension:

Note: The extension must be loaded both during obfuscation AND at runtime in production.

3. Publish Configuration

This will create config/obfuscator.php in your Laravel application.

4. Configure Encryption Key

Edit .env file and add:

Important: The encryption key will be shown after obfuscation. You must set it as PHP_BOLT_KEY constant in production.

Runtime Configuration (Production)

After obfuscating your code, you need to configure your production environment:

1. Install bolt.so Extension in Production

2. Define PHP_BOLT_KEY Constant

Add to your public/index.php or bootstrap file:

Without these steps, your obfuscated code will NOT run!

Configuration

The package configuration file (config/obfuscator.php) provides extensive options:

PHPBolt Extension Configuration

Include/Exclude Paths

Obfuscation Options

Backup Configuration

CI/CD Mode

Performance Settings

Usage

Available Commands

The package provides four Artisan commands:

1. Obfuscate Source Code

Run the main obfuscation process:

Options:

• --source=path - Override source paths (can be used multiple times: --source=app --source=routes)
• --destination=path - Override output directory (default: production/obfuscated)
• --production-ready - Create a complete Laravel project bundle with obfuscated files
• --dry-run - Simulate obfuscation without modifying files
• --backup - Create a backup before obfuscating (disabled by default)
• --force - Skip confirmation prompt
• -v|vv|vvv - Increase verbosity (Laravel built-in)

Examples:

🚀 Production-Ready Bundle Mode

The --production-ready flag creates a complete, deployable Laravel project with obfuscated files. This is perfect for deployment scenarios where you want a ready-to-deploy directory.

How It Works

1. Copies entire Laravel project to the destination directory
2. Excludes unnecessary files (tests, node_modules, .git, etc.)
3. Obfuscates specified files (replaces originals with obfuscated versions)
4. Keeps everything else intact (config files, public assets, vendor, etc.)

Usage

What Gets Included/Excluded

Excluded by default:

• .git/, .github/, tests/ - Version control and test files
• node_modules/, vendor/ - Dependencies (install via npm/composer in production)
• .env* files - Environment-specific (create in production)
• composer.lock, package-lock.json - Generated during install
• Cache and log files from storage/ and bootstrap/cache/
• Development configs (.editorconfig, phpunit.xml, etc.)

Always included:

• composer.json - Required for composer install --no-dev
• package.json - Required for npm install --production (if needed)
• artisan, public/index.php, server.php
• Your obfuscated source code (app/, routes/, etc.)
• Views, config files, migrations, public assets

Configuration: Edit config/obfuscator.php → production_bundle section to customize.

📖 Full Deployment Guide: See docs/PRODUCTION_DEPLOYMENT.md for complete step-by-step deployment instructions.

Example: Deploy-Ready Package

2. Check Configuration

Verify PHPBolt installation and preview files to be obfuscated:

Options:

• --show-files - Display complete list of files that will be obfuscated

Example:

3. View Status

Display obfuscation status and information:

Options:

• --report - Display the last obfuscation report

Example:

4. Clear Output/Backups

Clean obfuscated output and backup directories:

Options:

• --output - Clear only the output directory
• --backups - Clear only backup directories
• --force - Skip confirmation prompt

Examples:

CI/CD Integration

GitHub Actions Example

GitLab CI Example

Jenkins Pipeline Example

Best Practices

1. Test Before Production

Always test obfuscated code in a staging environment:

2. Exclude Blade Templates

Blade templates should generally not be obfuscated as they need to be parsed by Laravel:

3. Be Careful with Function/Class Scrambling

Scrambling function and class names can break:

• Reflection-based code
• Dynamic method calls
• External integrations

Start with these options disabled:

4. Maintain Backups

Always keep backups enabled:

5. Version Control

Add to .gitignore:

6. Monitor Performance

For large codebases, adjust performance settings:

Troubleshooting

PHPBolt Extension Not Loaded

Solution: Verify bolt.so extension is loaded:

Permission Denied

Solution: Ensure Laravel has write permissions:

Memory Limit Exceeded

Solution: Increase memory limit in configuration:

Files Not Being Obfuscated

Solution: Check your include/exclude patterns:

Security Considerations

1. Source Code Protection - Keep your original source code secure and separate from obfuscated versions
2. License Keys - Store PHPBolt license keys securely
3. Backup Security - Ensure backup directories are not publicly accessible
4. Deploy Only Obfuscated Code - Never deploy unobfuscated code to production
5. Access Control - Limit access to obfuscation commands in production environments

Performance Tips

1. Exclude Unnecessary Files - Only obfuscate what needs protection
2. Use Parallel Processing - Enable parallel processing for faster obfuscation
3. Optimize File Scanning - Use specific include paths rather than entire directories
4. CI/CD Caching - Cache PHPBolt installation in CI/CD pipelines

Support & Contributing

Issues

If you encounter any issues, please check:

1. PHPBolt installation and configuration
2. File permissions
3. Configuration file settings

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

License

This package is open-sourced software licensed under the MIT license.

Credits

• Alexandru Florea - Package Author
• PHPBolt - Obfuscation Engine
• Inspired by jaydeepukani/laravel-source-obfuscator for command-line path override ideas

Changelog

Version 1.0.0 (Initial Release)

• PHPBolt integration
• Configurable include/exclude paths
• Four CLI commands (run, check, status, clear)
• Automatic backup system
• CI/CD support
• Performance optimization options
• Comprehensive reporting

Roadmap

• [ ] Support for additional obfuscation engines
• [ ] Web-based configuration UI
• [ ] Real-time obfuscation monitoring
• [ ] Integration with Laravel Forge
• [ ] Docker support
• [ ] Advanced scheduling options

Note: PHPBolt is a commercial product. You need a valid PHPBolt license to use this package. This package is not affiliated with or endorsed by PHPBolt.