Alt Google 2Fa Laravel Package

Product Decisions This Supports

• Security & compliance roadmap: Informs whether to add two-factor authentication (TOTP-based Google Authenticator) to a Statamic-backed product to satisfy SOC 2, ISO 27001, or internal security baselines without building MFA from scratch.
• Build vs. buy: A purpose-built, installable Statamic addon (v1.1.3) that lets the team avoid spending engineering cycles on 2FA enrollment flows, recovery codes, and authenticator-app integration.
• Feature scoping: Helps frame what a "security add-on" actually delivers (login enforcement, user enrollment, admin controls) versus what still requires in-house work (recovery flows, audit logging, policy UX).
• Maintenance triage: The v1.1.3 release is a routine dependency bump ("Bump Statamic versions"), signaling ongoing compatibility upkeep rather than new capability — useful for deciding whether to schedule an upgrade or defer.
• Use cases: Client portals, internal admin dashboards, and any Statamic CMS with elevated-privilege users where account compromise has real business or reputational cost.

When to Consider This Package

Adopt when:

• The application runs on Statamic and needs TOTP/Google Authenticator-based 2FA with minimal custom code.
• Security posture (or a customer/auditor requirement) demands MFA for admin or editor accounts.
• The team prefers a small, single-purpose addon over a heavier identity provider or enterprise SSO integration.
• You value active version compatibility — v1.1.3 explicitly tracks upstream Statamic releases, reducing the risk of drift.

Look elsewhere when:

• You need enterprise SSO (SAML/OIDC), SCIM provisioning, or passwordless flows — a dedicated IdP is a better fit.
• The product requires hardware security keys (WebAuthn/FIDO2) or SMS fallback, which this addon may not cover.
• You're not on Statamic (or are on a version outside the bumped compatibility range) — verify supported Statamic/PHP versions before committing.
• You need mature recovery-code UX, audit trails, and self-service admin tooling out of the box; expect to build or integrate those.
• The project has strict vendor-risk rules and requires a larger maintainer base, published security policy, or long-term support commitments.

Note on v1.1.3: This is a maintenance release (Statamic version compatibility bump only). No breaking changes, deprecations, or new features. PM action: low-risk to adopt/upgrade; validate against your pinned Statamic version.

How to Pitch It (Stakeholders)

To executives: We can add Google Authenticator-based two-factor authentication to our Statamic platform by adopting a small, maintained addon rather than funding a custom build. This is a low-cost, low-risk way to materially strengthen account security and support compliance conversations with customers and auditors. The latest release (v1.1.3) is a routine compatibility update — a positive signal that the maintainer is keeping it aligned with current Statamic versions.

To engineering: This is a focused Statamic addon that handles TOTP/Google Authenticator enrollment and verification, letting us avoid reimplementing MFA primitives. v1.1.3 only bumps Statamic dependency versions — no API changes — so upgrading should be quick; confirm our Statamic/PHP versions fall within the supported range. Plan to layer on recovery flows and audit logging if we need them, and evaluate whether WebAuthn/SSO requirements are on the near-term roadmap before standardizing on TOTP-only.