centrex/laravel-courier

Repo bus factorcaution

All five recent commits came from one contributor, creating a real continuity risk. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations unclear. Dependabot is present, but it does not replace a documented reporting process.

Version stabilitycaution

v0.3.1 is not a stable major release, so its API may still change. It is not marked as a prerelease, which partly offsets that concern.

Workflow auditcaution

All 13 analyzed action references are unpinned, and four workflows grant top-level write permissions. A high-confidence bot-conditions finding in the Dependabot auto-merge workflow adds a meaningful workflow hygiene concern, although no untrusted checkout or script injection was detected.