arthurpar06/laravel-discord-notifier

Release historycaution

The package is only 67 days old with two releases, both within the last 12 months. This shows recent publishing activity but provides limited long-term maintenance evidence.

Repo bus factorcaution

One contributor made 100% of the 35 commits in the last three months. The linked project is user-owned rather than organization-owned, so there is no provided backing signal to offset this concentration.

Security policycaution

The repository has no security policy, leaving no stated process for reporting vulnerabilities or coordinating fixes. Dependabot provides some automated dependency monitoring, but it does not replace a disclosure process.

Version stabilitycaution

v0.2.0 is not a stable major release, so its pre-1.0 status indicates that compatibility may still change. It is not marked as a prerelease, which partly offsets that concern.

Workflow auditcaution

All 11 analyzed action references are unpinned, weakening build reproducibility. Three workflows grant top-level write permissions, but the pull_request_target workflow has no untrusted checkout or script-injection finding, so this is a hygiene concern rather than a severe workflow risk.