Recaptcha Bundle Laravel Package

Product Decisions This Supports

• Build vs. buy, decided firmly on "build." A reCAPTCHA form field is a commodity integration: one widget render, one server-side verification call to Google's siteverify endpoint, one validation rule. In Laravel this is roughly 30–60 lines (a Blade partial plus a custom validation rule wrapping Http::asForm()->post(...)). The "buy" side of this package is a zero-star, zero-dependent Symfony bundle — no economic case.
• Framework fit check on the roadmap. The package is a Symfony bundle (EWZRecaptchaBundle fork), not a Laravel package. Any roadmap item that assumed a drop-in Laravel integration should be re-scoped immediately; there is no service provider, no config publish, no Blade directive.
• Bot-mitigation strategy decision. Rather than adopting a wrapper, this is a trigger to decide the vendor: Google reCAPTCHA v2/v3 vs. Cloudflare Turnstile vs. hCaptcha. The wrapper is the least important part of that decision and the easiest to replace.
• Security/supply-chain risk triage. CAPTCHA sits directly on public, unauthenticated form endpoints — among the highest-exposure surfaces in the app. A single-maintainer package with 0 stars and 0 dependents is an unvetted dependency on a security boundary. This supports a "no" recommendation and, if it were ever adopted, a mandatory fork-and-vendor review.
• Migration/exit planning for legacy Symfony services. If any part of the estate still runs Symfony with the original EWZRecaptchaBundle, this repo can be catalogued as a possible stopgap while a native or official-form replacement is scheduled.
• Deprioritization of a "captcha module" epic. The low opportunity score (~30) matches the assessment: no differentiation, no user-visible value, no pricing leverage. It belongs in a compliance/table-stakes bucket, not a roadmap theme.

When to Consider This Package

Consider it only under a narrow, and largely unlikely, set of conditions:

• You are on Symfony (not Laravel), you already depend on the legacy EWZRecaptchaBundle API surface, and you need a short-term compatible fork to keep an existing form working while a proper migration is planned.
• Your security review explicitly accepts a single-maintainer, 0-star, 0-dependent dependency on a public-facing endpoint — and you have vendored/forked the code and pinned the commit.
• Your reCAPTCHA usage is genuinely form-field-shaped (Symfony Form type with a rendered widget and a constraint), so the bundle's abstraction saves real work rather than a handful of lines.

Look elsewhere — or build it yourself — when:

• You are on Laravel. Wrong framework; there is no integration path without writing the adapter yourself, at which point the package adds nothing.
• You need long-term maintenance guarantees. 0 stars, 0 dependents, and a single recent release are not evidence of a supportable dependency. No community means no security patch pipeline and no Stack Overflow surface.
• You want a modern bot-defence posture. Turnstile/hCaptcha and reCAPTCHA v3 are invisible and less user-hostile; a widget-oriented Symfony form field nudges you toward v2 checkbox UX.
• You care about vendor lock-in on the client side. The abstraction is thin enough that you gain little and inherit a dependency you will have to unwind.

Practical alternative for a Laravel/PHP team: implement the check natively (Http client + a recaptcha validation rule), or use a maintained, widely-adopted package if you want the sugar. Either way, keep the verification call behind your own interface so the vendor can be swapped.

How to Pitch It (Stakeholders)

To executives (one paragraph): We evaluated snipershady/recaptcha-bundle and recommend against adopting it. It is a Symfony-only wrapper around Google reCAPTCHA with no community traction — zero stars, zero dependent projects — maintained by a single author. The capability it provides is small and easily built in-house, so adopting it would add third-party risk to a security-sensitive, publicly reachable part of our product without saving meaningful engineering time. There is no cost, schedule, or roadmap impact to declining it; the work is a small, well-understood implementation we can own.

To engineering: This is a Symfony bundle, not a Laravel package — there is no drop-in path for our stack. The functionality is a form widget plus a server-side siteverify call, which we can implement behind a small BotVerification interface in well under a day, with tests. That interface also lets us swap vendors (reCAPTCHA → Turnstile) without touching form code. Recommendation: build natively, pin the vendor decision explicitly, and avoid introducing an unvetted single-maintainer dependency on an unauthenticated endpoint. If any legacy Symfony service already uses EWZRecaptchaBundle, treat this fork as a temporary pin only, with a scheduled replacement.