Gentle Force Laravel Package

Product Decisions This Supports

• Security-baseline gating: Whether brute-force protection on login, registration, password-reset, and OTP endpoints ships as a launch requirement or is deferred. Account takeover and credential stuffing are direct drivers of support cost, churn, and compliance findings (SOC 2 CC6, ISO 27001 A.9, PCI-DSS 8.x).
• Build vs buy for abuse prevention: Choosing between three tiers — (a) Laravel's native throttle middleware and RateLimiter facade, (b) app-level middleware like this package, (c) an edge/WAF product (Cloudflare, AWS WAF, Fastly). This package is the middle option: more flexible than native, cheaper than edge.
• Roadmap ownership: Whether abuse prevention is a centrally owned platform/security epic (consistent middleware conventions, shared keys) or delegated to feature teams — a classic platform-vs-product tension.
• Feature differentiation via graceful degradation: Error-rate limiting enables delaying suspicious traffic instead of hard-blocking it, preserving legitimate bursty users (mobile clients on flaky networks, batch importers) while still containing abuse.
• Concrete use cases it supports: per-IP and per-account login throttling, password-reset spam prevention, API-key abuse limits, error-pattern DoS detection, and escalating lockouts.

When to Consider This Package

Consider it when:

• You are on a Laravel version it actually supports — last release was 2021-08-26, so validate against your Laravel 9/10/11/12 target before anything else.
• You need behaviors Laravel's built-in throttle does not offer: error-response-based limiting, composite keys (user + IP + route), escalating penalties, or per-route custom policies.
• Your auth is custom (not Fortify/Breeze), so you do not already get login throttling for free.
• You have a small platform team and no edge/WAF budget — app-level middleware is the cheapest viable control.
• You want a reference implementation to adapt, not a long-term dependency.

Look elsewhere when:

• Maintenance risk is unacceptable. 43 stars, 0 dependents, and no release in roughly three years — consistent with its low community/opportunity scores. That is a red flag on a security-critical path; fork-and-own or copy the pattern.
• Laravel's native RateLimiter plus Redis already covers your needs; it is framework-maintained and usually sufficient.
• You need distributed, multi-region, edge-level protection or DDoS resilience — app middleware runs after the request has already hit your origin.
• You are on Fortify/Jetstream/Breeze, which include login throttling.
• You need dashboards, alerting, or audit logs for abuse events — this package provides none.

How to Pitch It (Stakeholders)

Executives: An MIT-licensed, zero-cost way to add brute-force and abuse protection to auth and public endpoints — reducing account-takeover risk, support load, and compliance findings without a WAF line item. The trade-off is maturity: low adoption and no release since 2021, so frame it as a pattern to evaluate, not a long-term platform bet.

Engineering: A small middleware package that sits on Laravel's cache/rate limiter and adds error-based and brute-force-specific limiting beyond the stock throttle. It is clean and well-scoped, but verify Laravel version compatibility first and budget for forking or vendoring. Recommended next step: a short spike comparing it against the native RateLimiter; if native covers ~80% of the need, lift the "gentle" escalation pattern into your own middleware rather than taking on a dependency that is several years stale.