pushery/visual-feedback-for-laravel

In-page feedback widget with client-side screenshot capture for Laravel and Livewire.
38 2
Install
composer require pushery/visual-feedback-for-laravel
Latest Version:v0.3.0
PHP:^8.4
License:MIT
Last Updated:Sep 3, 2026
Links: GitHub  ·  Packagist
Maintainer: pushery

Visual Feedback for Laravel

Latest Version PHP Version Laravel Versions Livewire 4.3+ License

Tests Coverage Type Coverage PHPStan Code Style Databases Mutation

In-page feedback widget with client-side screenshot capture for Laravel and Livewire.

Your users see the bug. This gets you the picture — plus the browser, the viewport, the URL and the scroll position they were at — without asking them to explain any of it.

Install

composer require pushery/visual-feedback-for-laravel
php artisan vendor:publish --tag=visual-feedback

Then place the widget once in your layout and point the mail channel somewhere — VISUAL_FEEDBACK_MAIL_TO ships empty, and a report with nowhere to go still shows the reporter a success screen. Needs PHP 8.4+, Laravel 12+ and Livewire 4.3+.

What it does

  • A Livewire widget in modal or inline mode — built-in floating button, standalone trigger, or a plain window event if you place your own.
  • Screenshot capture in two stages: the browser's own screen capture where it exists, falling back silently to a DOM renderer that works everywhere, including iOS. The report records which stage produced the image.
  • Region redaction that holds in both stages — the area is blacked out and input values cleared before anything is captured.
  • Two view trees — framework-free, or WireKit components that inherit your design tokens.
  • Delivery channels: mail, database and signed webhook, each isolated, individually queued, extensible with your own.
  • Abuse protection with no external service — honeypot, server-anchored time trap and rate limits, running underneath any gate you add rather than instead of it, so a challenge provider being down can never leave the form unprotected. The honeypot and the time trap depend on nothing outside the request; the rate limits go through your cache, and what happens when that is down is a setting. The one deliberate off switch is abuse.min_fill_seconds = 0, which disarms the time trap — the value test suites reach for, and worth checking before it reaches a published config.
  • Built to WCAG 2.1 AA, proven rather than asserted: a full axe sweep over every widget state in both trees, a keyboard-only run through the whole flow, and contrast measured on the values the browser actually rendered.

Documentation

Full docs: docs.pushery.com/visual-feedback-for-laravel

  • Installation — requirements, publish tags, where the widget goes
  • Configuration — every config key and its environment variable
  • The capture cascade — the two stages, and which one produced a report
  • Placing the trigger — the built-in button, your own, or the window event
  • View trees — framework-free, or WireKit with your design tokens
  • Delivery channels — mail, database, signed webhook, and adding your own
  • Report browser — the optional view over the reports table: route it, open the gate
  • Abuse protection — what the floor covers on its own, and the seam for adding your own gate
  • Privacy and retention — the notice, and how long anything is kept
  • Accessibility — what is proven, and the three things your page owes
  • Integration contract — CORS, CSP, and what the DOM stage does not reproduce
  • Testing — driving the widget from your own suite, and what the bundled suites already prove

Third-party notices

html2canvas-pro 2.4.1 (MIT) is bundled, and since 0.6.0 it sits in a file of its own: visual-feedback-renderer.iife.js for the classic build, visual-feedback.chunk.js for the ESM one. Neither is loaded until a screenshot is actually taken. The version and the filename are both named so you can match an advisory against what you actually ship -- and, if you serve the bundles from your own origin, know which file has to be there for a capture to succeed.

Security

Please review the security policy and report vulnerabilities privately rather than opening a public issue.

Built by Pushery

This package is built and maintained by Pushery — a Berlin-based studio building Laravel applications, SaaS products, and open-source tools.

Building a Laravel UI? WireKit, Pushery's open-source Livewire component kit, gives you a polished component library out of the box. Browse the rest of our work at pushery.com.

License

The MIT License (MIT). See LICENSE for details.

Related Packages