Events

Every event lives in RoundlyConsulting\TwoFactor\Events and carries the user model as $user — never a secret or a code. A few add a non-sensitive detail:

Listening

TwoFactorVerified and TwoFactorVerificationFailed let you audit challenges, meter success and failure rates, and drive host-side lockout without wrapping the facade — for example a listener that increments a rate limiter:

use Illuminate\Support\Facades\Event;
use Illuminate\Support\Facades\RateLimiter;
use RoundlyConsulting\TwoFactor\Events\TwoFactorVerificationFailed;

Event::listen(function (TwoFactorVerificationFailed $event): void {
    RateLimiter::hit("2fa:{$event->user->getKey()}");
});

Enrolment, disabling, recovery-code use and replay attempts are all announced too, so you can feed them into an audit log or alerting without extra plumbing.