Altcha Bundle Laravel Package

Product Decisions This Supports

• CAPTCHA vendor replacement. Altcha is a self-hosted, proof-of-work challenge instead of reCAPTCHA/hCaptcha. This bundle is the Symfony glue for it, so the decision it unlocks is: do we remove a third-party bot-mitigation dependency from our signup, login, password-reset, contact, and checkout flows?
• Privacy / compliance roadmap. No Google scripts, no third-party cookies, no user-image farming. This directly shrinks the consent-banner surface and the data-processor list in a GDPR/CCPA review — a roadmap item PMs usually can't close without swapping the CAPTCHA.
• Build vs. buy. Altcha itself is MIT and free; the real cost is integration + maintenance. This bundle collapses integration to config + a form-type/validator, so the build-vs-buy analysis becomes "one sprint of glue code" vs. "paid CAPTCHA tier."
• Vendor-risk reduction. Removes a hard dependency on an ad-tech company's terms, pricing changes, and regional availability (reCAPTCHA is blocked or degraded in some markets — relevant if you have users in mainland China or privacy-sensitive EU segments).
• Conversion/friction experiments. PoW challenges are typically invisible to humans (a second or two of client CPU), so PMs can A/B CAPTCHA-on vs. CAPTCHA-off vs. Altcha and measure form completion — a lever that's usually stuck because reCAPTCHA friction is non-negotiable.
• CSP posture / security roadmap (new in 3.1.0). The 3.1.0 release adds Content-Security-Policy support, which means the widget can be integrated without forcing a permissive script-src/unsafe-inline carve-out. For PMs this is a real unlock: security-conscious products (or customers with procurement security questionnaires) often block CAPTCHA vendors precisely because the vendor's script can't be constrained by CSP. This bundle now lets you keep a tight policy on nonce/hash terms — a checkbox that used to be a reason not to adopt Altcha.
• Stack-fit gate (important): This is a Symfony bundle, not a Laravel package. Despite how it's being framed, huluti/altcha-bundle (tito10047 fork) will not drop into a Laravel app. If your product is Laravel, the decision this informs is "do we adopt Altcha at all?" — and then you solve it with the vanilla JS widget plus a custom verification endpoint, or a Laravel-specific wrapper, not this repo.

When to Consider This Package

• Only if the service is Symfony (5.4/6.x/7.x — verify supported versions in composer.json before committing). On Laravel, Lumen, or a non-PHP frontend, stop here.
• You already want Altcha specifically — i.e., the privacy/self-hosted argument has been made and approved. This bundle is an accelerator, not a reason to adopt Altcha.
• Forms are standard Symfony Forms and you want server-side validation wired into the existing validator pipeline rather than hand-rolling a controller check.
• You maintain a strict Content-Security-Policy. With 3.1.0's CSP support, this is now a legitimate adoption enabler: if your current blocker is "the vendor's script forces unsafe-inline," re-run that evaluation — it may no longer apply.
• You can absorb maintenance risk. 20 stars and 0 dependents means effectively no community backstop. Treat it as "vendored sample code," not "a library with a support contract": pin an exact version, read the whole source (it should be small), and be prepared to own it.
• Verification hygiene before adoption: confirm the release history is real and current (the listed latest release, 2026-05-29, should be sanity-checked against the repo), check test coverage in CI, check issue responsiveness, and diff the fork against upstream huluti/altcha-bundle to understand what tito10047 changed and why. The 3.1.0 notes show a mix of upstream work (CSP, from @Huluti) and fork-local work (the type-exception fix), so confirm both tracks land in the release you pin.
• Look elsewhere when: you need an SLA or security disclosure process; you need image/behavioral challenges for high-threat abuse (credential stuffing at scale, scraping); you need managed dashboards and bot analytics; you need a supported library across multiple stacks (PHP + Node + mobile); or the CAPTCHA sits on a revenue-critical path where a broken release costs more than the license fee you saved.

How to Pitch It (Stakeholders)

To executives: Altcha is a free, MIT-licensed, self-hosted alternative to reCAPTCHA that keeps user data in our infrastructure and off Google's. This Symfony bundle is the integration layer — small, low-risk, and reversible. Adopting it removes a third-party processor from our privacy review and eliminates a per-request dependency on an ad-tech vendor's terms and pricing. Cost is engineering time, not license fees. The latest release (3.1.0) is a backwards-compatible minor bump: a bug fix and, more importantly, Content-Security-Policy support — which means we can adopt it without loosening the browser security policy that our security team and enterprise customers care about. Recommended as a scoped pilot on two or three low-risk forms before any wider rollout.

To engineering: It's a thin Symfony wrapper around the Altcha widget and challenge verification — expect configuration plus a form type/validator, not a framework. 3.1.0 adds configurable CSP support (PR #73) and fixes a type exception (PR #71); no breaking changes flagged, so the pin can move from 3.0.x to 3.1.x on the pilot. Caveats to state plainly: it's a small fork with ~20 stars and zero dependents, so we pin the version, vendor or review the source, add an integration test around the verify endpoint, and keep a feature flag to fall back to the current CAPTCHA. Also flag the framing mismatch up front: this is Symfony-only — if the target app is Laravel, we're evaluating Altcha, not this package, and the integration path is different.

Ask: one engineer, roughly one to two weeks, behind a flag, on non-critical forms, with a documented rollback. Extend scope slightly to validate the new CSP path against our current policy in staging. Success = no measurable drop in form completion and zero bot-mitigation regressions over a four-week window.