Download the PHP package cboxdk/laravel-risk without Composer
On this page you can find all versions of the php package cboxdk/laravel-risk. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download cboxdk/laravel-risk
More information about cboxdk/laravel-risk
Files in cboxdk/laravel-risk
Package laravel-risk
Short Description Cbox Risk — an explainable, config-driven request risk-scoring pipeline for Laravel. Weights signals (IP reputation, geo, disposable email, velocity, bot timing) into a score and an outcome: allow, challenge, step-up, or reject.
License MIT
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package laravel-risk
Cbox Risk
An explainable, config-driven request risk-scoring pipeline for Laravel. It weights independent signals — IP reputation, disposable email, bot user-agents, honeypot/submit-timing — into a score, and maps that score to a graduated outcome: allow, flag, challenge, step-up, or reject. Every decision comes with the reasons behind it, so you can tune it, explain it, and defend it.
Why this exists
Every auth/anti-abuse tool in the Laravel ecosystem is either a single-signal hard blocker (one IP list, one honeypot) or an opaque paid cloud (Akismet, CleanTalk) whose verdicts you can't explain. Neither fits an identity platform, where a wrong block locks a real user out and a regulator may ask why you made an automated decision. Cbox Risk is the missing middle: many signals, a transparent weighted score, graduated friction instead of a binary block, and a full reasons breakdown on every assessment — self-hosted, free-core, no data leaving your server.
Free-core signals (ship working, zero paid deps, clean licenses)
| Signal | What it catches | Source |
|---|---|---|
| Honeypot + timing | Bots that fill hidden fields or submit in <2s | built-in (spatie technique) |
| User-Agent | curl/python-requests/headless clients, missing Accept headers |
built-in |
| Disposable email | Throwaway signup addresses | bundled list (refresh from amieiro, MIT) |
| MX record | Email domains that can't receive mail (undeliverable = fake) | DNS |
| Velocity | Too many requests from one IP (stored HMAC-only) | your cache |
| IP reputation | Addresses on many blocklists | stamparm/ipsum (Unlicense) via risk:refresh-ipsum |
| Tor exit | Requests via a Tor exit node (moderate) | official list via risk:refresh-tor |
Opt-in signal (ships, enable in config): StopForumSpam — cached, short timeout, fail-open (data is CC BY-NC, fine for self-hosters).
Opt-in drivers (bring your own key/implementation): AbuseIPDB, Spamhaus DQS,
Project Honey Pot, IPQualityScore, MaxMind GeoLite2, HIBP breach API — each a
Signal or a bound IpReputation/DisposableDomains provider. No hard
dependency on any paid API; an unconfigured signal contributes 0, never an error.
Install
Schedule the IP-reputation refresh (daily):
Monitor first, enforce later
The package ships in monitor mode: it scores and you log, but you do not
act on the outcome yet. Calibrate the thresholds against your real traffic — then
flip RISK_MODE=enforce. Anti-abuse tools that block on install cause outages;
this one refuses to.
The scoring model
Weighted-additive and deliberately not machine learning: score = Σ (signal points × weight), mapped to the most severe outcome band it reaches. It's
explainable by construction — $assessment->reasons() tells you exactly which
signals fired and why. See docs/core-concepts/architecture.md.
Defaults (all configurable): Flag ≥15, Challenge ≥30, Step-up ≥60, Reject ≥80. Allowlisted IPs and email domains bypass scoring entirely.
Outcomes
| Outcome | Meaning | Typical action |
|---|---|---|
Allow |
Looks fine | proceed |
Flag |
Slightly odd | proceed, but log for review |
Challenge |
Suspicious | CAPTCHA / proof-of-work |
StepUp |
Risky | extra auth factor / email verification |
Reject |
Almost certainly abuse | refuse (or hold for review) |
Custom signals
Implement Cbox\Risk\Contracts\Signal and add it to config('risk.signals'):
Privacy & GDPR
IP addresses and fingerprints are personal data. Fraud prevention is a recognized
legitimate interest (GDPR Recital 47), but you owe users explainability and human
review under Article 22 — which is exactly why this scorer is transparent, not
a black box. See docs/security/index.md for the Art. 22 guidance,
data-minimization defaults, and retention advice.
License
MIT © Cbox. Security policy: SECURITY.md.
All versions of laravel-risk with dependencies
illuminate/contracts Version ^12.0 || ^13.0
illuminate/http Version ^12.0 || ^13.0
illuminate/support Version ^12.0 || ^13.0