Open source we build and depend on

Attaches files to Eloquent models in named buckets or as global media on any disk: image variants, private/S3-presigned URLs with safe response headers, per-owner dedup, direct browser-to-S3 uploads adopted without copying, strict MIME mode, storage metering, placeholders, srcset, CDN URLs, SSRF guard.

Native SVG QR codes with typed payloads — links, 2FA, Wi-Fi, vCards, SEPA transfers and PAY by square.

Single- and multi-language slugs for Eloquent — scoped uniqueness, locale-aware routing and 301s from old URLs.

Multilingual Eloquent attributes in a single JSON column — with a fallback chain so content never renders blank.

A multilingual, SEO-ready blog engine — translatable content, publishing lifecycle, categories and tags.

Typed taxonomies for any model — flat or nested, curated or free-form, tenant-scoped and translatable, with autocomplete.

Exact, immutable money values — ISO 4217 currencies, rounding-safe math, discounts, tax and ECB exchange rates.

Apple, Google Play and Stripe purchases and subscriptions: verified, deduplicated webhooks, models, refunds, lifecycle events, plus Stripe billing — per-seat, metered and mixed-interval plans, card-free trials, portal.

Manage advertisements, placements and pricing.

Create, manage and apply discount coupons with flexible rules.

Ledger-based credit balance on any Eloquent model: grant/deduct, holds with capture/release/expiry, scheduled per-period bucket resets, overdraft protection, point-in-time balance, named and currency buckets.

An e-commerce foundation — products, variants, carts, orders, tax and stock across single or multiple shops.

Trading performance analytics — P&L, returns, streaks, profit factor, Sharpe and drawdown.

Polymorphic comments on any model — threaded replies, moderation, likes, reports, group mentions, edit history and attachments.

Send campaigns to multiple recipients.

Many-to-many connections between models with permissions and expirations.

Typed polymorphic contacts (email, phone, URL, social) with normalization and vCard export.

Lightweight likes and typed reactions on any entity, with idempotent toggles.

Realtime threads and direct messages between entities using Laravel broadcasting, with channel authorisation.

Write reviews to any entity from any entity — star ratings, moderation, verified badges and helpful votes.

Typed notifications — an in-app inbox, per-user preferences, mandatory types, email de-dup, quiet hours, digests, date-based reminders, one-click unsubscribe, a suppression list and mail rate limits.

Database-defined, multi-step forms — per-field validation, drafts, file uploads and stored submissions.

Opening hours, seasonal schedules, holidays and bookable slots for any model — DST-correct and native.

Scheduling between entities — a status state machine, recurrence engine and ICS export.

Polymorphic approvals between models — quorum and weighted rules, delegation, staged pipelines, self-approval exclusion and version-bound rounds.

Define and track multiple onboarding flows with required and optional steps.

Flag and moderate entities — typed reasons and a guarded resolution lifecycle.

Requests from entities with a built-in, native approvals subsystem.

Teams for any Eloquent model, keyed by bigint, UUID or ULID: memberships with roles and permissions, per-team role overrides, expiring email invitations, join requests, membership start/end dates, checked team switching, per-team data isolation (current-team context, fail-closed scoped models, queue propagation with membership re-check), optional nested teams and scoped time-boxed grants via permissions-for-laravel.

Status lifecycles for Eloquent models — guarded transitions, race-free quotas, expiry, scheduling, rollbacks and history.

A headless helpdesk — gap-free references, swappable statuses, internal notes, guest links, merging and a JSON API.

Real-world events — venues with near-me search, ticket types, RSVPs with a race-free waitlist, QR check-in and .ics feeds.

Versioned workflows as JSON graphs or a PHP builder, run step by step on queues: triggers, signed webhooks, conditions, approvals, durable waits, business-time escalations, retries, dry-runs and file sync.

Turn any Eloquent query into dashboard-ready value, trend, progress and partition metrics.

Allow-list-driven filtering, sorting and capped pagination for API list endpoints — everything else is rejected.

Store billing, shipping or other addresses on any model via a polymorphic relationship.

Attach dynamic, typed key/value attributes to any model — with cross-attribute validation, encryption, constraints and an audit trail of who changed what.

Convenient helper methods for PHP enums — labels, options, collections and random values.

Global or per-entity settings with typed casts, encrypted values and in-request caching.

CSV and XLSX imports into Eloquent models — templates with dropdowns, saved column mappings, a validated preview, background batches and undo.

Headless multi-guard auth — password, magic link, email code and passkey login, 2FA, JWT sessions, enumeration-safe sign-up and pre-hijacking protection.

Native, audited crypto primitives — JWS, JWK, X.509, TOTP, WebAuthn, HMAC and strict codecs, with zero config.

Query Google Places, Routes and Geocoding from Laravel — autocomplete, place search, geocoding, travel times and photos.

Throttle outgoing HTTP client requests — per-second to per-day limits, shared stores and adaptive backoff.

Native RS256 user tokens and HS256 service tokens — guards, a jti denylist and claim-based authorization.

Build Laravel packages on a fluent provider builder — publish-only migrations, key-type schema macros and config guards.

A native WebAuthn / FIDO2 passkey relying party — registration, sign-in and attestation with zero third-party crypto.

Roles and direct permissions for any authenticatable model: single-guard, cache-backed effective-permission resolution wired into Laravel’s Gate and can: middleware, plus optional per-scope (tenant/team/project), time-boxed and tenant-defined roles.

A typed Plausible Analytics client — query stats, capture server-side events and revenue, and provision sites.

Opaque, rotating refresh tokens and device sessions — hashed at rest, with reuse detection and one-call logout everywhere.

Dev-only Pest assertions that can always fail — migration order, config contracts, model swaps and arch presets.

Native TOTP two-factor authentication — encrypted secrets, single-use recovery codes and replay protection.

Schedule recurring health checks, send throttled alerts when they fail and fire events on escalation and recovery.

Provision TLS certificates from Laravel — native ACME/Let's Encrypt, wildcards and expiry monitoring.

Resolve a client's location and travel distance through pluggable geolocation providers.

Access GitHub, GitLab and Bitbucket through a single Laravel-native API — with webhooks and write ops.

A fluent, Eloquent-style client for the Kubernetes API — 20+ resources, logs, scale, rollout and watch.

Tamper-evident seals for Eloquent models, an append-only ledger, idempotency keys, nonces and RFC 9421 HTTP signatures.

SSRF protection for Laravel’s HTTP client and Guzzle clients — Http::safe() DNS-pins every hop and blocks private, loopback and cloud-metadata addresses; size and time caps, capped fetch() and download() and a safe_url rule.

Receive and send signed webhooks (Standard Webhooks, RFC 9421, custom schemes): replay-safe queued handlers, retries with backoff, per-endpoint throttle, SSRF guard, secret rotation, delivery log.