PHPackages                             cboxdk/laravel-risk - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. cboxdk/laravel-risk

ActiveLibrary[Security](/categories/security)

cboxdk/laravel-risk
===================

Cbox Risk — an explainable, config-driven request risk-scoring pipeline for Laravel. Weights signals (IP reputation, geo, disposable email, velocity, bot timing) into a score and an outcome: allow, challenge, step-up, or reject.

v1.1.1(3w ago)6819↑92.5%MITPHPPHP ^8.4CI passing

Since Jul 12Pushed 2w agoCompare

[ Source](https://github.com/cboxdk/laravel-risk)[ Packagist](https://packagist.org/packages/cboxdk/laravel-risk)[ RSS](/packages/cboxdk-laravel-risk/feed)WikiDiscussions main Synced 1w ago

READMEChangelog (3)Dependencies (14)Versions (6)Used By (0)

Cbox Risk
=========

[](#cbox-risk)

An **explainable, config-driven request risk-scoring pipeline** for Laravel. It weights independent signals — IP reputation, disposable email, bot user-agents, honeypot/submit-timing — into a score, and maps that score to a graduated outcome: **allow, flag, challenge, step-up, or reject**. Every decision comes with the reasons behind it, so you can tune it, explain it, and defend it.

```
use Cbox\Risk\Facades\Risk;
use Cbox\Risk\ValueObjects\RiskContext;

$assessment = Risk::assess(RiskContext::fromRequest($request, action: 'register', attributes: [
    'honeypot' => $request->input('nickname'),        // an invisible field
    'form_rendered_at' => $request->integer('rendered_at'),
]));

if ($assessment->atLeast(Outcome::Challenge)) {
    // show a CAPTCHA, require step-up, or reject — your call, per the outcome
}
```

Why this exists
---------------

[](#why-this-exists)

Every auth/anti-abuse tool in the Laravel ecosystem is either a **single-signal hard blocker** (one IP list, one honeypot) or an **opaque paid cloud** (Akismet, CleanTalk) whose verdicts you can't explain. Neither fits an identity platform, where a wrong block locks a real user out and a regulator may ask *why* you made an automated decision. Cbox Risk is the missing middle: **many signals, a transparent weighted score, graduated friction instead of a binary block, and a full reasons breakdown on every assessment** — self-hosted, free-core, no data leaving your server.

Free-core signals (ship working, zero paid deps, clean licenses)
----------------------------------------------------------------

[](#free-core-signals-ship-working-zero-paid-deps-clean-licenses)

SignalWhat it catchesSource**Honeypot + timing**Bots that fill hidden fields or submit in <2sbuilt-in (spatie technique)**User-Agent**`curl`/`python-requests`/headless clients, missing Accept headersbuilt-in**Disposable email**Throwaway signup addressesbundled list (refresh from [amieiro, MIT](https://github.com/amieiro/disposable-email-domains))**MX record**Email domains that can't receive mail (undeliverable = fake)DNS**Velocity**Too many requests from one IP (stored HMAC-only)your cache**IP reputation**Addresses on many blocklists[stamparm/ipsum](https://github.com/stamparm/ipsum) (Unlicense) via `risk:refresh-ipsum`**Tor exit**Requests via a Tor exit node (moderate)[official list](https://check.torproject.org/torbulkexitlist) via `risk:refresh-tor`**Opt-in signal** (ships, enable in config): **StopForumSpam** — cached, short timeout, fail-open (data is CC BY-NC, fine for self-hosters).

**Opt-in drivers** (bring your own key/implementation): AbuseIPDB, Spamhaus DQS, Project Honey Pot, IPQualityScore, MaxMind GeoLite2, HIBP breach API — each a `Signal` or a bound `IpReputation`/`DisposableDomains` provider. **No hard dependency on any paid API**; an unconfigured signal contributes 0, never an error.

Install
-------

[](#install)

```
composer require cboxdk/laravel-risk
php artisan vendor:publish --tag=risk-config
```

Schedule the IP-reputation refresh (daily):

```
// routes/console.php
Schedule::command('risk:refresh-ipsum')->daily();
```

Monitor first, enforce later
----------------------------

[](#monitor-first-enforce-later)

The package **ships in `monitor` mode**: it scores and you log, but you do **not**act on the outcome yet. Calibrate the thresholds against your real traffic — then flip `RISK_MODE=enforce`. Anti-abuse tools that block on install cause outages; this one refuses to.

The scoring model
-----------------

[](#the-scoring-model)

Weighted-additive and deliberately **not** machine learning: `score = Σ (signal points × weight)`, mapped to the most severe outcome band it reaches. It's explainable by construction — `$assessment->reasons()` tells you exactly which signals fired and why. See [`docs/core-concepts/architecture.md`](docs/core-concepts/architecture.md).

Defaults (all configurable): Flag ≥15, Challenge ≥30, Step-up ≥60, Reject ≥80. Allowlisted IPs and email domains bypass scoring entirely.

Outcomes
--------

[](#outcomes)

OutcomeMeaningTypical action`Allow`Looks fineproceed`Flag`Slightly oddproceed, but log for review`Challenge`SuspiciousCAPTCHA / proof-of-work`StepUp`Riskyextra auth factor / email verification`Reject`Almost certainly abuserefuse (or hold for review)Custom signals
--------------

[](#custom-signals)

Implement `Cbox\Risk\Contracts\Signal` and add it to `config('risk.signals')`:

```
final class GeoVelocitySignal implements Signal
{
    public function key(): string { return 'geo.velocity'; }

    public function evaluate(RiskContext $context): ?SignalResult
    {
        // return new SignalResult('geo.velocity', 30, 'impossible travel') or null
    }
}
```

Privacy & GDPR
------------------

[](#privacy--gdpr)

IP addresses and fingerprints are personal data. Fraud prevention is a recognized legitimate interest (GDPR Recital 47), but you owe users **explainability and human review** under **Article 22** — which is exactly why this scorer is transparent, not a black box. See [`docs/security/index.md`](docs/security/_index.md) for the Art. 22 guidance, data-minimization defaults, and retention advice.

License
-------

[](#license)

MIT © Cbox. Security policy: [SECURITY.md](SECURITY.md).

###  Health Score

49

—

FairBetter than 94% of packages

Maintenance95

Actively maintained with recent releases

Popularity25

Limited adoption so far

Community8

Small or concentrated contributor base

Maturity55

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 76.9% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~6 days

Total

5

Last Release

26d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/b9761a79e61f2d5b9d650510dfb3555da18daf38f027aa84012c937e397e39a7?d=identicon)[cboxdk](/maintainers/cboxdk)

---

Top Contributors

[![sylvesterdamgaard](https://avatars.githubusercontent.com/u/2431914?v=4)](https://github.com/sylvesterdamgaard "sylvesterdamgaard (10 commits)")[![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4)](https://github.com/dependabot[bot] "dependabot[bot] (3 commits)")

---

Tags

abuseanti-botfraudlaravelrisksecurityspamlaravelsecurityspamAbuseanti-botfraudrisk

###  Code Quality

TestsPest

Static AnalysisPHPStan

Code StyleLaravel Pint

### Embed Badge

![Health badge](/badges/cboxdk-laravel-risk/health.svg)

```
[![Health](https://phpackages.com/badges/cboxdk-laravel-risk/health.svg)](https://phpackages.com/packages/cboxdk-laravel-risk)
```

###  Alternatives

[psalm/plugin-laravel

Psalm plugin for Laravel

3365.5M359](/packages/psalm-plugin-laravel)[laravel/mcp

Rapidly build MCP servers for your Laravel applications.

80732.6M270](/packages/laravel-mcp)[laravel/socialite

Laravel wrapper around OAuth 1 & OAuth 2 libraries.

5.7k118.2M1.0k](/packages/laravel-socialite)[laravel/scout

Laravel Scout provides a driver based solution to searching your Eloquent models.

1.7k59.5M712](/packages/laravel-scout)[illuminate/auth

The Illuminate Auth package.

10528.8M1.4k](/packages/illuminate-auth)[illuminate/routing

The Illuminate Routing package.

1419.6M3.8k](/packages/illuminate-routing)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)