batyukovstudio/max-laravel-notification-channel

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This adds execution during installation, but the signal provides no evidence that the script is unsafe.

Release historycaution

The package is about six months old and has only two releases, both published within roughly two hours, so there is limited evidence of an established release cadence.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, leaving limited evidence of ongoing maintenance after the initial release burst.

Security policycaution

The repository has no SECURITY.md policy, which reduces transparency for reporting vulnerabilities, though this is not evidence of a vulnerability itself.

Workflow auditcaution

All five workflows were analyzed successfully with no reported audit findings or untrusted checkouts. However, all 17 action references are unpinned and one workflow grants top-level write permissions, creating avoidable maintenance and workflow supply-chain exposure.