Laraguard Laravel Package

Product Decisions This Supports

• Shipping 2FA without building it: Laraguard provides TOTP enrollment (secret + QR provisioning), verification, recovery codes, and rate-limited confirmation — directly informing "do we build or adopt" decisions for account security in a Laravel product.
• Build vs. buy for security primitives: lets the team defer in-house work on TOTP/QR/recovery-code UX and redirect engineering to core product differentiators.
• Compliance and sales enablement: MFA is a checklist item in SOC 2, ISO 27001, HIPAA, and enterprise security questionnaires; adopting it unblocks deals that require MFA.
• Roadmap scoping: the package's feature surface (TOTP only, recovery codes, Fortify integration, no SMS/WebAuthn/push) helps define what "2FA" means in roadmap commitments and avoids over-promising.
• On-prem / privacy positioning: no external identity provider dependency — supports data-residency, air-gapped, and "no third-party auth vendor" product claims.
• Reference architecture: even if not adopted, its design is a useful blueprint for an internal build when the archived status is a blocker.

When to Consider This Package

Consider it when:

• You have an existing Laravel app and need TOTP-based 2FA in days rather than sprints.
• Your Laravel version is compatible with the 2022-era release (roughly Laravel 8/9) and you're comfortable pinning dependencies.
• You require on-premises, self-hosted 2FA with no external vendor (data residency, procurement, or air-gapped constraints).
• TOTP plus recovery codes is sufficient — no SMS, push, WebAuthn/passkeys, or hardware tokens required.
• You're evaluating patterns and want a vetted reference implementation before committing to a build.

Look elsewhere when:

• The package is archived and unmaintained — no security patches, no current Laravel support. This is the dominant consideration: dependency and CVE risk, upgrade friction, and no upstream fixes.
• You need modern Laravel support — Laravel Fortify ships first-party TOTP + recovery codes and is actively maintained; prefer it for new builds.
• You need phishing-resistant auth (WebAuthn/passkeys), SMS, or enterprise SSO/SAML — out of scope here.
• Your security policy forbids unmaintained third-party dependencies, or you lack capacity to fork and maintain it internally.
• You need a supported vendor, SLAs, or a security response process.

How to Pitch It (Stakeholders)

To executives: This is a small, MIT-licensed Laravel package that adds two-factor authentication — a recurring enterprise sales and compliance requirement — without introducing a third-party identity vendor. It can compress delivery of an MFA feature from a sprint to days and supports "data stays on-prem" positioning in security reviews. Key caveat: the project is archived and has not been updated since early 2022, so we should treat it as either (a) a short-term accelerator only if we accept maintenance ownership, or (b) a reference design for a small internal build. Recommendation: use Laravel's first-party Fortify for production; use Laraguard to accelerate scoping or as a fallback where version constraints allow.

To engineering: Minimal integration surface — TOTP enrollment, QR provisioning, recovery codes, rate limiting, and Fortify hooks. But it's archived and untested against current Laravel; adopting it means forking, patching, and owning security updates. If we adopt, budget for ongoing maintenance; if we don't, its patterns remain a useful blueprint. For new work, Fortify is the lower-risk default.